Password Reset Vulnerability in Goobi Viewer by Intranda

CVE-2026-46347

What is CVE-2026-46347?

The Goobi Viewer web application exhibits a vulnerability due to the predictable generation of replacement passwords during the password reset process. Prior to version 26.05, the application's method for creating a new password lacked sufficient randomness, allowing attackers to exploit this flaw via brute force techniques. This could occur if the victim triggered the password reset and the attacker managed to correlate the server-side generation time through network or email metadata. This issue has been resolved in version 26.05, enhancing the security of password management within the application.

References