CVE-2026-55486
The Goobi viewer is a web application that allows digitised material to be displayed in a web…
- Risk score
- 69/100
- CVSS
- 9.3 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Goobi viewer has a reflected XSS vulnerability in its IIIF Auth 2.0 endpoints, allowing an attacker to inject malicious code. An attacker could exploit this vulnerability to steal sensitive information or take control of the user's session.
- Affected
- {'products': ['Goobi viewer'], 'packages': [], 'versions': ['25.08']}
- Fix
- Upgrade to version 26.05 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.3 critical
- Remotely exploitable without logging in
References
Original description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.
Last activity 23 Oct 2026. Patch Forecast updates every hour.