The vulnerability allows an unauthenticated attacker to replay a previously captured author token because the token transfer endpoint has no expiration enforcement and returns the raw token. This results in the attacker being able to receive new author cookies and impersonate the original author, granting unauthorized read and write access to collaborative pads. The weakness corresponds to information disclosure (CWE‑200) and the lack of cleanup or expiration leading to reuse (CWE‑294).

The issue affects Etherpad versions ranging from 2.6.0 through 3.0.x. Versions 3.1.0 and later contain the fix. The affected product is the Etherpad real‑time collaborative editor provided by the ether:etherpad CNA.

The CVSS score of 6.8 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. No EPSS data is available, so the likelihood of exploitation is uncertain but the exposed token endpoint provides a straightforward remote attack vector. An attacker merely needs to obtain a valid transfer UUID, which can be generated by querying the GET endpoint, and can then repeatedly redeem it to obtain author cookies. Because the UUID is not validated for expiration or deletion after use, the risk of sustained impersonation exists, especially if an attacker can harvest multiple tokens.