CVE-2026-55457

The Goobi viewer web application is vulnerable to an unauthenticated authorization bypass prior to version 26.05 . The root cause is that Configuration.getWebApiToken returns an empty string when webapi.authorization.token is not configured, and the AuthorizationFilter fails to verify if the conf...