CVE-2026-55463

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

CVE-2026-55463

The Goobi viewer web application (versions 4.11.0 to before 26.05 ) is vulnerable to authentication and origin validation bypasses in its goobi-viewer-core component. Specifically, several Jakarta WebSocket endpoints (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, and UserEndpoint)...

CVE-2026-55463 Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

EUVD-2026-109065

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

PT-2026-122133

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...