WebSocket Vulnerability in Goobi Viewer Affects User Authentication
CVE-2026-55463

6.5MEDIUM

Key Information:

Vendor

Intranda

Status
Goobi-viewer-core
Vendor
CVE Published:
23 October 2026

What is CVE-2026-55463?

The Goobi Viewer, a web application for displaying digitized materials, suffers from a security flaw where several Jakarta WebSocket endpoints (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) do not verify that the connected HttpSession belongs to a logged-in user. Additionally, they fail to validate the Origin header against a predefined allowlist. This oversight enables unauthenticated attackers to connect to these endpoints, particularly through the CampaignEndpoint, which allows them to tamper with the in-process crowdsourcing page-lock map and send fraudulent lock messages, potentially disrupting the workflow of legitimate reviewers. Users are urged to upgrade to version 26.05, which addresses this vulnerability and enhances security.

Affected Version(s)

goobi-viewer-core >= 4.11.0, < 26.05

References

https://github.com/intranda/goobi-viewer-core/security/ad...
x_refsource_CONFIRM
https://github.com/intranda/goobi-viewer-core/commit/8714...
x_refsource_MISC
https://github.com/intranda/goobi-viewer-core/releases/ta...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.