CVE-2026-55088 in Etherpad exposes a credential disclosure vulnerability in the pad author token transfer feature. The critical issue: an unauthenticated endpoint accepts token transfer requests, stores the author token indefinitely without expiration, and returns the token in cleartext via the response body. An attacker who knows a transfer UUID can redeem it to obtain a fresh author cookie plus the cleartext token itself—giving them the credential, not just a derived session. This enables offline credential generation at scale, not merely session hijacking.
Three compounding failures created this exposure. First, tokens have no defined terminal condition—they're never deleted after redemption, leaving the state machine in an undefined but valid state. Second, the UUID-only secret model treated enumeration resistance as sufficient protection, when the actual attack surface was anyone who obtains the UUID gaining full impersonation capability. Third, the feature was designed for narrow trust contexts (same-browser tab transfer) but deployed as an API endpoint with no corresponding reduction in attack surface.
The createdAt field present in the codebase but unused in redemption logic exemplifies a recognizable pattern: defensive metadata that signals capability without functional enforcement. This decorative security creates false confidence during code review and is a consistent precursor to authentication bypasses across vulnerability histories.
For defenders: verify whether your Etherpad instance (versions prior to 3.1.0) has transfer tokens in the database that were never redeemed or cleaned up—these represent accumulated exposure windows. The fix in 3.1.0 adds expiration enforcement and post-redemption deletion, but you should also audit for orphaned tokens created under the vulnerable version. More broadly, treat any endpoint that returns credentials in cleartext as a trust boundary violation regardless of its apparent purpose—this pattern (credential-as-ticket, treating transferable author tokens like conference badges rather than passwords) has historical precedent in session fixation vulnerabilities and represents institutional forgetting that modern frameworks are not immune to.