CVE-2026-55486Critical· 9.3▾ MidnightThe Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.
goobi-viewer-core >= 25.08, < 26.05Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55444Medium· 5.3Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters
CVE-2026-55442Medium· 5.3Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection
CVE-2026-55459High· 7.4Goobi viewer: OpenID JWT audience not enforced by the verifier
CVE-2026-46346Medium· 6.5Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset
CVE-2026-55457High· 7.4Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass
CVE-2026-46347Medium· 6.8Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset