CVE-2026-55089
Etherpad OAuth authorization_code path authorizes /api/2/* requests without a valid API key
- Severity
- critical
- Affected product
- Etherpad
- Affected versions
- Etherpad ≥ 2.1.0, < 3.1.0
- Fixed in
- Etherpad 3.1.0
- Added to NewScan
- 2026-08-20
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints Etherpad from its response and reports this CVE when the detected version falls inside the affected range below.
9.9. src/node/handler/APIHandler.ts treats a request on the authorization_code OAuth path as authorized for the whole /api/2/* surface, which is Etherpad's full pad-management API (read, create, overwrite and delete every pad, and mint session tokens). Range is the vendor advisory GHSA-qfmh-fph3-mw8q, `from 2.1.0 until 3.1.0`. Version-match only: proving it live would mean issuing authorized API calls against a customer's pads. Reachable as of today because the new Etherpad tech_signatures row supplies the version from GET /health (releaseId) - measured 2026-08-20 against etherpad/etherpad:3.0.0 (this row fires) and :3.3.3 (it does not).
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →