Skip to content

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Moderate severity GitHub Reviewed Published Jun 10, 2026 in ether/etherpad • Updated Aug 17, 2026

Package

npm ep_etherpad-lite (npm)

Affected versions

<= 1.8.14

Patched versions

3.3.0

Description

Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes:

  • Weak RNG for tokens (CWE-330): author/session/readonly IDs were generated with Math.random() (client and server). Now use crypto.getRandomValues.
  • Login timing / no failure delay (CWE-208/CWE-307): the OIDC interaction login used a non-constant-time password compare with no failure delay. Now uses crypto.timingSafeEqual plus a uniform failure delay; user lookup is own-property only.
  • Plugin dependency path handling (CWE-22): plugin dependency names from package.json were used to build filesystem paths without validation (admin-gated install). Now validated against the npm name grammar.
  • API parameter pollution (CWE-235): /api/2 merged all request headers into the API field set. Now forwards only authorization, matching the openapi.ts handler.
  • Pad-creation side effect: API.appendChatMessage could create arbitrary pads (missing getPadSafe). Now requires the pad to exist.
  • Error info disclosure (CWE-209): the admin file server echoed filesystem error detail; now returns a generic message.

References

@JohnMcLear JohnMcLear published to ether/etherpad Jun 10, 2026
Published to the GitHub Advisory Database Aug 17, 2026
Reviewed Aug 17, 2026
Last updated Aug 17, 2026

Severity

Moderate

EPSS score

Weaknesses

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Learn more on MITRE.

Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. Learn more on MITRE.

Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data. Learn more on MITRE.

Improper Handling of Extra Parameters

The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount. Learn more on MITRE.

Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. Learn more on MITRE.

CVE ID

No known CVE

GHSA ID

GHSA-92hr-gmr6-h8cp

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.