CVE-2026-55459

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

CVE-2026-55459 Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

CVE-2026-55459

The Goobi viewer web application (versions 25.01 to before 26.05 ) contains an authentication vulnerability in AuthenticationEndpoint.verifyOpenIdToken. The application fails to enforce the aud claim during cryptographic validation when building the JWT verifier. Instead, it performs a manual str...

CVE-2026-55459 Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

EUVD-2026-109063

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

PT-2026-122132

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...