PatchSiren cyber security CVE debrief
CVE-2026-55088 ether CVE debrief
Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/{uuid}. Although the record includes createdAt, the transfer has no expiration check, is not removed after successful redemption, and is returned by res.send(tokenData), including the raw author token. An unauthenticated attacker who obtains a transfer UUID can repeatedly redeem it, receive fresh author cookies, read the cleartext token, and impersonate the originating author for pad read and write operations. This issue is fixed in version 3.1.0. The vulnerability allows an attacker to repeatedly redeem a transfer UUID, receive fresh author cookies, read the cleartext token, and impersonate the originating author for pad read and write operations. Etherpad users should prioritize patching to prevent potential author token exposure. To verify, defenders should review the official CVE record and NVD entry for CVE-2026-55088, and check their Etherpad instances for version 3.1.0 or later. They should also monitor for suspicious token transfer activity and review existing author tokens.
- Vendor
- ether
- Product
- etherpad
- CVSS
- MEDIUM 6.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-19
- Original CVE updated
- 2026-08-21
- Advisory published
- 2026-08-19
- Advisory updated
- 2026-08-21
Who should care
Etherpad users and administrators should be aware of this vulnerability and take steps to patch and monitor their instances. They should review their current Etherpad version and update to version 3.1.0 or later. Additionally, they should review existing author tokens and monitor for suspicious token transfer activity. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified.
Technical summary
Etherpad's token transfer feature exposes author tokens through GET requests, allowing unauthenticated attackers to impersonate authors. The vulnerability is fixed in version 3.1.0. To prevent potential author token exposure, Etherpad users should prioritize patching. The vulnerability allows an attacker to repeatedly redeem a transfer UUID, receive fresh author cookies, read the cleartext token, and impersonate the originating author for pad read and write operations.
Defensive priority
Etherpad users should prioritize patching to prevent potential author token exposure.
Recommended defensive actions
- Apply the patch in Etherpad version 3.1.0 or later
- Review and update existing author tokens
- Monitor for suspicious token transfer activity
- Confirm whether affected Etherpad deployments exist in managed environments and assign an owner for follow-up.
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
Evidence notes
The CVE record and NVD entry provide details on the vulnerability in Etherpad's token transfer feature. However, the source corpus lacks additional context or statements from the vendor. To verify, defenders should review the official CVE record and NVD entry for CVE-2026-55088, and check their Etherpad instances for version 3.1.0 or later. They should also monitor for suspicious token transfer activity and review existing author tokens.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T20:17:17.883Z and has not been modified since then.