Skip to content
OpenAdvisories

Vendor

intranda

16 known vulnerabilities.

Products

goobi-viewer-core 16
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.4
    CVE-2026-55459

    Goobi viewer: OpenID JWT audience not enforced by the verifier

    The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build(…

    intranda goobi-viewer-core
  • High 7.4
    CVE-2026-55457

    Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass

    The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compare…

    intranda goobi-viewer-core