CVE-2026-55088
1 advisory.
npm/ep_etherpad-lite CVE-2026-55088: medium 6.8
ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
Action: Upgrade ep_etherpad-lite to 3.1.0 or later.
npm i ep_etherpad-lite@3.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.6.0 | 3.1.0 | - |
Fixed versions
| 3.1.0 |
Sources
- osv: GHSA-vqfp-p66c-xrp9
- https://github.com/ether/etherpad/security/advisories/GHSA-vqfp-p66c-xrp9
- https://github.com/ether/etherpad/pull/7784
- https://github.com/ether/etherpad
CVE-2026-55088 · published · modified · JSON