Read the docs
TI-2026-79934 Aliases CVE-2026-55459

Goobi viewer accepts OpenID tokens issued for other relying parties

Priority LOW 34CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Goobi viewer (intranda goobi-viewer-core) from 25.01 before 26.05 does not enforce the JWT aud claim when verifying OpenID tokens. A later manual check compares only single-string aud values, so a token issued for another relying party passes. An unauthenticated remote attacker with such a token can log in as the token's subject in multi-relying-party setups (CWE-287).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00205 10th percentileScored 2026-11-07
Fix Fixed goobi-viewer-core (intranda): 26.05

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
intrandagoobi-viewer-core25.01 to before 26.0526.05Patch availableCNA
  • goobi-viewer-core Vendorintranda Affected 25.01 to before 26.05 Fixed in 26.05 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:*——intranda
  • cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:* Versions — — ·intranda

Remediation

Upgrade Goobi viewer (goobi-viewer-core) to version 26.05, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA goobi-viewer-core (intranda) Fixed in 26.05

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-55459

References

Other 3

  • TI-2026-79924 Path traversal in Goobi viewer lets malicious servers write files CVSS 3.1CRITICAL 9.8
  • TI-2026-79923 Unauthenticated SSRF and local file inclusion in Goobi viewer CVSS 3.1CRITICAL 9.8
  • TI-2026-32930 Goobi viewer: Unauthenticated Solr Streaming Expression Proxy CVSS 3.1CRITICAL 9.8
  • TI-2020-11897 Path traversal in Goobi viewer Core CVSS 3.1CRITICAL 9.6
  • TI-2026-79937 Reflected XSS in Goobi viewer IIIF Auth authorization endpoints CVSS 3.1CRITICAL 9.3
  • TI-2026-79920 Predictable password reset token in Goobi viewer CVSS 3.1MEDIUM 6.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences