Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-46347 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time. Exploiting this finding in isolation requires the victim to have triggered the reset themselves and the attacker to infer the server time from network or email metadata. This issue has been patched in version 26.05.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CNA: [email protected]CVSS-B:6.8 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/intranda/goobi-viewer-core/commit/1fa7a30a3a7699a82ea0df9c1a8997b2894d7841	[email protected]	Source CodeVendor
https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef	[email protected]	Source CodeVendor
https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05	[email protected]	Release NotesVendor
https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-hw9w-7r6g-2fjc	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-330	Use of Insufficiently Random Values	[email protected]
CWE-340	Generation of Predictable Numbers or Identifiers	[email protected]
CWE-640	Weak Password Recovery Mechanism for Forgotten Password	[email protected]

Affected Products

Product	Versions
intranda Goobi viewer	< 26.05
CPE cpe:2.3:a:intranda:goobi_viewer_core:::::::: Remediation Upgrade: 26.05moderate effort Mitigation:low effort Disable the password reset endpoint by configuring a reverse proxy or Tomcat block. Note that this will prevent all users from resetting their passwords. For Apache httpd, add the following block to the vhost configuration: <LocationMatch ^.user/resetpw/.$> Require all denied </LocationMatch> For Tomcat, add the following security constraint to the relevant web.xml: <security-constraint> <web-resource-collection> <web-resource-name>blocked endpoint</web-resource-name> <url-pattern>/user/resetpw/</url-pattern> <url-pattern>/user/resetpw/*</url-pattern> </web-resource-collection> <auth-constraint/> </security-constraint>

Product

Versions

intranda Goobi viewer

< 26.05

CPE

cpe:2.3:a:intranda:goobi_viewer_core:*:*:*:*:*:*:*:*

Remediation

Upgrade: 26.05moderate effort
Mitigation:low effort
Disable the password reset endpoint by configuring a reverse proxy or Tomcat block. Note that this will prevent all users from resetting their passwords. For Apache httpd, add the following block to the vhost configuration: <LocationMatch ^.*user/resetpw/.*$> Require all denied </LocationMatch> For Tomcat, add the following security constraint to the relevant web.xml: <security-constraint> <web-resource-collection> <web-resource-name>blocked endpoint</web-resource-name> <url-pattern>/user/resetpw/</url-pattern> <url-pattern>/user/resetpw/*</url-pattern> </web-resource-collection> <auth-constraint/> </security-constraint>

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 29, 2026	CVE Modified	CISA-ADP
Oct 23, 2026	New CVE Received	[email protected]