CVE-2026-55457
The Goobi viewer is a web application that allows digitised material to be displayed in a web…
- Risk score
- 57/100
- CVSS
- 7.4 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first chec…
- Affected
- See advisory
- Fix
- Upgrade the product to 26.05 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.4 high
- Remotely exploitable without logging in
References
Original description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.
Last activity 23 Oct 2026. Patch Forecast updates every hour.