CVE-2026-55457: CWE-287: Improper Authentication in intranda goobi-viewer-core
Description
CVE-2026-55457 is an improper authentication vulnerability in intranda goobi-viewer-core versions prior to 26.05. The issue arises because the application returns an empty string as a default token when no web API token is configured, and the authorization filter accepts requests with an empty token parameter. This allows unauthorized access to endpoints protected by authorization bindings. The vulnerability has been patched in version 26.05.
CVSS v3.1
Score 7.4high
Affected software
intranda
goobi-viewer-core
pkg:github/intranda/goobi-viewer-coreRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Goobi viewer web application prior to version 26.05 has an authentication flaw where Configuration.getWebApiToken returns an empty string if the webapi.authorization.token is not set. The AuthorizationFilter compares the supplied token against this empty default without verifying if a token is configured. Consequently, requests to any endpoint protected by @AuthorizationBinding with an empty token parameter are accepted, bypassing authentication. This vulnerability is fixed in version 26.05.
Potential Impact
An attacker can bypass authentication by supplying an empty token parameter to protected endpoints, gaining unauthorized access to sensitive functionality or data. The CVSS 3.1 score is 7.4 (high), indicating high confidentiality and integrity impact without availability impact.
Mitigation Recommendations
Upgrade to intranda goobi-viewer-core version 26.05 or later, where this authentication bypass vulnerability has been fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T22:10:37.607Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6adb6fb54d27ba8daa33ac61
Added to database: 10/23/2026, 14:31:17 UTC
Last enriched: 10/23/2026, 14:45:25 UTC
Last updated: 10/23/2026, 14:46:02 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.