Password Reset Vulnerability in Goobi Viewer Web Application by Intranda

CVE-2026-46346

What is CVE-2026-46346?

The Goobi Viewer, a web application designed for displaying digitized materials, exhibits a security vulnerability prior to version 26.05, whereby the password reset token is generated in a predictable manner based on the timestamp of the reset request. This flaw allows attackers with knowledge of the target's email address to initiate a password reset request and potentially brute-force the token. Successful exploitation results in the ability to force unauthorized password resets on user accounts. Intranda has addressed and mitigated this issue in the latest release.

References