CVE-2026-46346 Details
Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.
A vulnerability in Goobi Viewer prior to version 26.05 allows for unauthorized password resets. The issue arises because the password reset token is predictably generated based on the time of the reset request. An attacker aware of the target's email can request a password reset and brute-force the token. This exploitation alone forces a password reset on any account. The vulnerability has been patched in version 26.05.
Users can update to Goobi Viewer version 26.05, where this vulnerability has been fixed. Instructions for blocking the password reset endpoint until the update can be deployed are also available.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef | [email protected] | Source CodeVendor |
| https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05 | [email protected] | Release NotesVendor |
| https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-gj5g-4rxf-8rmq | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-330 | Use of Insufficiently Random Values | [email protected] |
| CWE-340 | Generation of Predictable Numbers or Identifiers | [email protected] |
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| intranda Goobi viewer | < 26.05 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |