CVE-2026-55459— Goobi viewer: OpenID JWT audience not enforced by the verifier
Quick assessment
Affected
intranda goobi-viewer-core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Goobi Viewer 是一款 Web 应用程序，用于在浏览器中展示数字化资源。在 25.01 版本至 26.05 版本之前， 方法通过 构建验证器，但未在密码学验证过程中强制检查 （受众）声明。该 检查随后通过一次简单的字符串相等性调用手动执行，仅能处理单个字符串类型的 值。在存在多个依赖方（multi-RP）的身份提供方（IdP）环境中，若某个令牌的单个字符串 值与 Viewer 的客户端 ID 匹配，但该令牌实际是颁发给其他依赖方的，则该令牌仍能通过验证，导致攻击者以令牌中的 （主体）身份成功认证。此问题已
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| intranda | goobi-viewer-core | >= 25.01, < 26.05 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55459
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Goobi viewer: OpenID JWT audience not enforced by the verifier
Source: CVE Program / CVE List V5
Vulnerability Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| intranda | goobi-viewer-core | >= 25.01, < 26.05 | - |
|
II. Public POCs for CVE-2026-55459
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55459
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55459 (1)
Vendor Advisories for CVE-2026-55459 (1)
Vendor Pages for CVE-2026-55459 (1)
-
🔗 Release Release v26.05 · intranda/goobi-viewer-core · GitHub x_refsource_MISC
Same Patch Batch · intranda · 2026-10-23 · 11 CVEs total
| CVE-2026-46651 | 9.8 CRITICAL | Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi |
| CVE-2026-46652 | 9.8 CRITICAL | Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables re |
| CVE-2026-55486 | 9.3 CRITICAL | Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected |
| CVE-2026-55457 | 7.4 HIGH | Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorizati |
| CVE-2026-46347 | 6.8 MEDIUM | Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Rese |
| CVE-2026-55463 | 6.5 MEDIUM | Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation |
| CVE-2026-46346 | 6.5 MEDIUM | Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset |
| CVE-2026-55442 | 5.3 MEDIUM | Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection |
| CVE-2026-55465 | 5.3 MEDIUM | Goobi viewer: Solr injection via unvalidated region parameter in spatial search |
| CVE-2026-55444 | 5.3 MEDIUM | Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters |
IV. Related Vulnerabilities
Same product: goobi-viewer-core
-
CVE-2026-55486
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — C -
CVE-2026-55465
Goobi viewer: Solr injection via unvalidated region paramete -
CVE-2026-55463
Goobi viewer: WebSocket endpoints lack server-side authentic -
CVE-2026-55457
Goobi viewer: Empty webapi.authorization.token default permi -
CVE-2026-55444
Goobi viewer: Solr query injection via the legacy RSS servle
Same vendor: intranda
-
CVE-2026-55486
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — C -
CVE-2026-55465
Goobi viewer: Solr injection via unvalidated region paramete -
CVE-2026-55463
Goobi viewer: WebSocket endpoints lack server-side authentic -
CVE-2026-55457
Goobi viewer: Empty webapi.authorization.token default permi -
CVE-2026-55444
Goobi viewer: Solr query injection via the legacy RSS servle
Same weakness: CWE-287
-
CVE-2026-55457
Goobi viewer: Empty webapi.authorization.token default permi -
CVE-2026-56837
PraisonAI LinearBot processes unsigned webhooks when LINEAR_ -
CVE-2026-56836
PraisonAI recipe serve Typer command bypasses the non-localh -
CVE-2026-93489
ASUS 路由器固件身份验证绕过漏洞 -
CVE-2026-97785
AAD App Proxy Elevation of Privilege Vulnerability
V. Comments for CVE-2026-55459
No comments yet