CVE-2026-55486 Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then 1 embe...

CVE-2026-55486

The Goobi viewer web application (versions 25.08 to before 26.05 ) is vulnerable to reflected XSS and CSP malformation due to an unsanitized origin query parameter in the IIIF Auth 2.0 endpoints (auth/login and auth/token) within AuthorizationFlowResource. The application fails to validate this p...

EUVD-2026-109067

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then 1 embe...

CVE-2026-55465 Goobi viewer: Solr injection via unvalidated region parameter in spatial search

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...

EUVD-2026-109066

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...

CVE-2026-55465

The Goobi viewer web application (versions 22.04 to before 26.05 ) is vulnerable to Solr injection via an unauthenticated REST endpoint: GET /api/v1/index/{solrField}/spatial/search. The root cause is the direct concatenation of the user-supplied region query parameter into a Solr query string wi...

CVE-2026-55465 Goobi viewer: Solr injection via unvalidated region parameter in spatial search

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version 26.05, the unauthenticated REST endpoint GET /api/v1/index/solrField/spatial/search concatenates the user-supplied region query parameter directly into a Sol...

CVE-2026-55463 Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

EUVD-2026-109065

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

CVE-2026-55463 Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

CVE-2026-55463

The Goobi viewer web application (versions 4.11.0 to before 26.05 ) is vulnerable to authentication and origin validation bypasses in its goobi-viewer-core component. Specifically, several Jakarta WebSocket endpoints (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, and UserEndpoint)...

CVE-2026-55459 Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

EUVD-2026-109063

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

CVE-2026-55459

The Goobi viewer web application (versions 25.01 to before 26.05 ) contains an authentication vulnerability in AuthenticationEndpoint.verifyOpenIdToken. The application fails to enforce the aud claim during cryptographic validation when building the JWT verifier. Instead, it performs a manual str...

CVE-2026-55459 Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

CVE-2026-55459 Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

CVE-2026-55457

The Goobi viewer web application is vulnerable to an unauthenticated authorization bypass prior to version 26.05 . The root cause is that Configuration.getWebApiToken returns an empty string when webapi.authorization.token is not configured, and the AuthorizationFilter fails to verify if the conf...

EUVD-2026-109062

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this...

CVE-2026-55457 Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this...

CVE-2026-55457 Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this...