ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartex

Description

Etherpad’s device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body

Recommendation

Update the ep_etherpad-lite package to the latest compatible version. Followings are version details:

Affected version(s): >= 2.6.0, <= 3.0.0
Patched version(s): 3.1.0

References

GHSA-vqfp-p66c-xrp9
CVE-2026-55088
CWE-200
CWE-294
CAPEC-310
OWASP 2021-A1
OWASP 2021-A6
OWASP 2021-A7

Could your website be exposed too?

SmartScanner can check your website for ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartex and gives you actionable findings to investigate.

Start a free scan

Related Issues

ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header - CVE-2026-55087
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink- - CVE-2026-55086
Etherpad Lite Access Restriction Bypass - CVE-2018-6835
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) - CVE-2026-41321

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated August 13, 2026