CVE-2026-55457 Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this...

CVE-2026-55457

The Goobi viewer web application is vulnerable to an unauthenticated authorization bypass prior to version 26.05 . The root cause is that Configuration.getWebApiToken returns an empty string when webapi.authorization.token is not configured, and the AuthorizationFilter fails to verify if the conf...