SB2026110430 - Improper Authentication in Etherpad

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110430

SB2026110430 - Improper Authentication in Etherpad

Published: November 4, 2026

Security Bulletin ID SB2026110430
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to impersonate other token-less clients, disrupt their connections, and perform unauthorized pad deletion or settings changes.

The vulnerability exists due to improper authentication in Etherpad's author identity resolution when processing CLIENT_READY messages without an author-token cookie or legacy token field. A remote attacker can omit both tokens to obtain the shared author ID stored under token2author:null, write under other token-less clients' identity, and trigger the duplicate-author check to disconnect them.

Deleting a pad with a token-less PAD_DELETE message or changing its pad-wide settings requires that a token-less client authored the pad's revision 0. The import endpoint also uses the shared author resolution path for requests without a token cookie.


Remediation

Install update from vendor's website.

References