Etherpad Lite versions prior to 3.3.0 contained several security weaknesses: token IDs (author/session/readonly) were generated using insecure Math.random(), enabling potential predictability (CWE-330). The OpenID Connect login process used a non-constant-time password comparison without failure delay, allowing timing attacks (CWE-208, CWE-307). Plugin dependency names from package.json were used to construct filesystem paths without validation, risking path traversal (CWE-22). The API v2 endpoint merged all request headers into the API field set, causing parameter pollution (CWE-235). The API.appendChatMessage function could create pads unintentionally due to missing existence checks. Lastly, the admin file server disclosed detailed filesystem error information (CWE-209). These issues were fixed by switching to crypto.getRandomValues, using crypto.timingSafeEqual with uniform failure delay, validating plugin names against npm grammar, restricting API header forwarding to authorization only, requiring pad existence before appending chat messages, and returning generic error messages.

The vulnerabilities could allow attackers to predict token values, perform timing attacks to glean login information, exploit path traversal via plugin installation, manipulate API parameters, create unauthorized pads, and gain sensitive error information. These issues collectively weaken the security posture but do not indicate direct remote code execution or privilege escalation. The impact is moderate, focusing on information disclosure, authentication weaknesses, and potential unauthorized resource creation.

A patch is available and should be applied to upgrade Etherpad Lite to version 3.3.0 or later. The fixes address all identified weaknesses. No additional mitigation steps are required beyond applying the official update.