CVE-2026-55486: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in intranda goobi-viewer-core

The intranda goobi-viewer-core application versions >=25.08 and <26.05 contain a reflected cross-site scripting vulnerability (CWE-79) due to improper neutralization of the origin query parameter in the IIIF Auth 2.0 endpoints auth/login and auth/token within AuthorizationFlowResource. The unvalidated origin parameter is embedded directly into the Content-Security-Policy: frame-ancestors response header and into a JavaScript single-quoted postMessage argument in the HTML response body. Because an attacker can control both login and token calls initiating the flow, this leads to reflected XSS. The issue was addressed and patched in version 26.05.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to complete compromise of confidentiality and integrity of user data (high confidentiality and integrity impact). Availability is not affected. The CVSS v3.1 score is 9.3 (critical). There are no known exploits in the wild at this time.

A patch is available in intranda goobi-viewer-core version 26.05 that fixes this vulnerability. Users should upgrade to version 26.05 or later to remediate the issue. No other mitigation steps are indicated by the vendor advisory.