CVE-2026-55459: CWE-287: Improper Authentication in intranda goobi-viewer-core
Description
CVE-2026-55459 is an improper authentication vulnerability in intranda goobi-viewer-core versions 25.01 up to but not including 26.05. The flaw arises because the application does not properly enforce the 'aud' claim in JWT tokens during cryptographic validation, allowing tokens issued for different relying parties to be accepted if their single-string 'aud' matches the viewer's client ID. This can lead to an attacker authenticating as another user. The issue is fixed in version 26.05.
CVSS v3.1
Score 7.4high
Affected software
intranda
goobi-viewer-core
pkg:github/intranda/goobi-viewer-coreRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Goobi viewer web application versions >=25.01 and <26.05 improperly validate JWT tokens in AuthenticationEndpoint.verifyOpenIdToken by building the verifier without enforcing the 'aud' claim during cryptographic validation. Instead, the 'aud' claim is checked manually afterward via a single string equality, which only supports single-string 'aud' values. In multi-relying party identity provider setups, this allows a token intended for a different relying party but with a matching single-string 'aud' to pass validation, enabling an attacker to authenticate as the token's subject. The vulnerability is patched in version 26.05.
Potential Impact
An attacker can exploit this vulnerability to bypass proper authentication checks in the Goobi viewer, potentially impersonating other users by presenting tokens issued for different relying parties. This leads to unauthorized access with high confidentiality and integrity impact, but no availability impact is indicated.
Mitigation Recommendations
Upgrade intranda goobi-viewer-core to version 26.05 or later, where the vulnerability has been fixed by properly enforcing the 'aud' claim during JWT token validation. No other mitigation is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T22:10:37.607Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6adb6fb54d27ba8daa33ac62
Added to database: 10/23/2026, 14:31:17 UTC
Last enriched: 10/23/2026, 14:45:22 UTC
Last updated: 10/23/2026, 14:46:02 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.