Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

published 2026-10-23 17 d ago modified 2026-10-30 10 d ago also EUVD-2026-109062

cvss: 7.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits: 0; none known

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.

Patch / fix

fixed in 1 links 2

intranda goobi_viewer_core 26.05

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 10 d ago (2026-10-30)

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

intranda goobi-viewer-core

Classification

Weakness

CWE-287 Improper Authentication
CWE-1392 Use of Default Credentials

References

Sources

CVE List CVE-2026-55457
NVD CVE-2026-55457

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary