CVE-2026-55486

The Goobi viewer web application (versions 25.08 to before 26.05 ) is vulnerable to reflected XSS and CSP malformation due to an unsanitized origin query parameter in the IIIF Auth 2.0 endpoints (auth/login and auth/token) within AuthorizationFlowResource. The application fails to validate this p...

CVE-2026-55486 Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then 1 embe...