THREAT OPS › Threat News › [GHSA] GHSA-92hr-gmr6-h8cp (medium) — Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling
[GHSA] GHSA-92hr-gmr6-h8cp (medium) — Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling
GHSA-92hr-gmr6-h8cp Severity: medium CVE: None
Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling
Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes:
- **Weak RNG for tokens (CWE-330):** author/session/readonly IDs were generated with `Math.random()` (client and server). Now use `crypto.getRandomValues`. - **Login timing / no failure del
Original source: https://github.com/advisories/GHSA-92hr-gmr6-h8cp