Improper Authentication in Etherpad - #VU159243
Published: November 4, 2026
Vulnerability details
The vulnerability allows a remote attacker to impersonate other token-less clients, disrupt their connections, and perform unauthorized pad deletion or settings changes.
The vulnerability exists due to improper authentication in Etherpad's author identity resolution when processing CLIENT_READY messages without an author-token cookie or legacy token field. A remote attacker can omit both tokens to obtain the shared author ID stored under token2author:null, write under other token-less clients' identity, and trigger the duplicate-author check to disconnect them.
Deleting a pad with a token-less PAD_DELETE message or changing its pad-wide settings requires that a token-less client authored the pad's revision 0. The import endpoint also uses the shared author resolution path for requests without a token cookie.