Sign in
Deutsch English Español Polski
Medium

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

  • Disclosed: 17.08.2026
  • Updated: 11.10.2026 10:22

Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes:

  • Weak RNG for tokens (CWE-330): author/session/readonly IDs were generated with Math.random() (client and server). Now use crypto.getRandomValues.
  • Login timing / no failure delay (CWE-208/CWE-307): the OIDC interaction login used a non-constant-time password compare with no failure delay. Now uses crypto.timingSafeEqual plus a uniform failure delay; user lookup is own-property only.
  • Plugin dependency path handling (CWE-22): plugin dependency names from package.json were used to build filesystem paths without validation (admin-gated install). Now validated against the npm name grammar.
  • API parameter pollution (CWE-235): /api/2 merged all request headers into the API field set. Now forwards only authorization, matching the openapi.ts handler.
  • Pad-creation side effect: API.appendChatMessage could create arbitrary pads (missing getPadSafe). Now requires the pad to exist.
  • Error info disclosure (CWE-209): the admin file server echoed filesystem error detail; now returns a generic message.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package ep_etherpad-lite < 3.3.0 3.3.0

References

CVSS score -
Weakness (CWE)
CWE-208, CWE-209, CWE-22, CWE-235, CWE-330
Platform
npm
Package
ep_etherpad-lite
Disclosed
17.08.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-92hr-gmr6-h8cp - CC BY 4.0

Vulnerability history: ep_etherpad-lite

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries
6
First → latest
05.2022 08.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 1
  • Medium 4

Disclosures per year

  1. Etherpad has stored XSS in HTML export via unescaped attribute-pool values
    High CVE-2026-55090 < 3.3.0 3.3.0
  2. Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling this entry
    Medium ghsa-92hr-gmr6-h8cp < 3.3.0 3.3.0
  3. ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
    Medium · 6.8 CVE-2026-55088 >= 2.6.0, < 3.1.0 3.1.0
  4. ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
    Medium · 4.2 CVE-2026-55086 < 3.1.0 3.1.0
  5. ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
    Medium · 6.1 CVE-2026-55087 >= 2.1.0, < 3.1.0 3.1.0
  6. Etherpad Lite Access Restriction Bypass
    Critical · 9.8 CVE-2018-6835 < 1.6.3 1.6.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.