Description

Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/{uuid}. Although the record includes createdAt, the transfer has no expiration check, is not removed after successful redemption, and is returned by res.send(tokenData), including the raw author token. An unauthenticated attacker who obtains a transfer UUID can repeatedly redeem it, receive fresh author cookies, read the cleartext token, and impersonate the originating author for pad read and write operations. This issue is fixed in version 3.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-19T20:17:17.883Z",
  "pubdate": "2026-08-19T20:17:17.883Z",
  "executiveSummary": "An insecure direct object reference and missing token expiration vulnerability exists in Etherpad versions 2.6.0 through 3.1.0.\nThe flaw resides in the token transfer mechanism implemented within the express application routing.\nAn unauthenticated attacker who obtains a valid transfer UUID can indefinitely exploit the endpoint to redeem author tokens, retrieve cleartext sensitive session data, and impersonate the originating victim.\nThis leads to complete unauthorized session hijacking and full read and write access to sensitive collaborative documents.\nThe vulnerability requires no prior authentication or specialized privileges, only the capability to intercept or guess the transfer UUID exposed through the GET endpoint.\nRisk implications include data exposure, integrity compromise of collaborative pads, and complete loss of non-repudiation for author actions.\nRemediation requires upgrading the Etherpad deployment to version 3.1.0 or later, where the underlying logic flaw is addressed.",
  "technicalDetails": "The vulnerability affects Etherpad from version 2.6.0 until 3.1.0.\nThe vulnerable component is identified as src/node/hooks/express/tokenTransfer.ts, which exposes two primary HTTP methods on the /tokenTransfer route.\nThe POST /tokenTransfer endpoint is utilized to store an author token intended for secure transfer between disparate browsers.\nSubsequently, the stored record is exposed via the GET /tokenTransfer/{uuid} endpoint.\nThe root cause of the vulnerability stems from multiple design and implementation failures within the token management logic:\n1. The application fails to enforce an expiration check on the stored token record despite retaining a createdAt timestamp.\n2. The token record is not invalidated or removed from storage immediately following a successful redemption.\n3. The server responds with res.send(tokenData), which improperly discloses the raw cleartext author token directly in the HTTP response body.\nThe step-by-step attack flow proceeds as follows:\nFirst, an unauthenticated attacker obtains a target transfer UUID through information leakage, interception, or prediction.\nSecond, the attacker issues repeated GET requests to the GET /tokenTransfer/{uuid} endpoint using the acquired UUID.\nThird, because the application lacks single-use enforcement, expiration validation, and post-redemption deletion, the server processes each request successfully.\nFourth, the server returns the persistent token data containing the raw author token and yields fresh author cookies to the requester.\nFinally, the attacker leverages the harvested cleartext token and cookies to impersonate the originating author, granting the attacker full privileges to perform arbitrary pad read and write operations.\nThe network exposure is broad, as the express endpoints are accessible remotely over HTTP or HTTPS without requiring authentication or prior session establishment."
}