Read the docs
TI-2026-79920 Aliases CVE-2026-46346

Predictable password reset token in Goobi viewer

Priority LOW 35CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-640.

Summary

Goobi viewer (intranda goobi-viewer-core) before 26.05 bases its password reset token on the time of the reset request, which makes the token predictable (CWE-330). An unauthenticated remote attacker who knows a target's email address can request a reset and brute-force the token. This forces an unauthorized password reset on any account.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00334 26th percentileScored 2026-11-07
Fix Fixed goobi-viewer-core (intranda): 26.05

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
intrandagoobi-viewer-corebefore 26.0526.05Patch availableCNA
  • goobi-viewer-core Vendorintranda Affected before 26.05 Fixed in 26.05 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:*——intranda
  • cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:* Versions — — ·intranda

Remediation

The source description states that the issue is patched in version 26.05, so upgrade intranda goobi-viewer-core to version 26.05 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA goobi-viewer-core (intranda) Fixed in 26.05

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-46346
  2. 2026-10-23 CISA SSVC decision points changed
  3. 2026-10-24 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-79924 Path traversal in Goobi viewer lets malicious servers write files CVSS 3.1CRITICAL 9.8
  • TI-2026-79923 Unauthenticated SSRF and local file inclusion in Goobi viewer CVSS 3.1CRITICAL 9.8
  • TI-2026-32930 Goobi viewer: Unauthenticated Solr Streaming Expression Proxy CVSS 3.1CRITICAL 9.8
  • TI-2020-11897 Path traversal in Goobi viewer Core CVSS 3.1CRITICAL 9.6
  • TI-2026-79937 Reflected XSS in Goobi viewer IIIF Auth authorization endpoints CVSS 3.1CRITICAL 9.3
  • TI-2026-79935 Goobi viewer WebSocket endpoints lack authentication checks CVSS 3.1MEDIUM 6.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences