CVE-2026-55457High· 7.4▾ TwilightThe Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. Autho…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.
goobi-viewer-core < 26.05Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55459High· 7.4Goobi viewer: OpenID JWT audience not enforced by the verifier
CVE-2026-55444Medium· 5.3Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters
CVE-2026-55442Medium· 5.3Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection
CVE-2026-46346Medium· 6.5Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset
CVE-2026-46347Medium· 6.8Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset
CVE-2026-55463Medium· 6.5Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation