CVE-2026-46346
SSVC: noneGoobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
6.5
MEDIUM
Scored by github.com (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
6.5
MEDIUM
Scored by CNA (GitHub_M) · v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
EPSS exploit probability
0.5%
Percentile 39.3%
as of 2026-10-24
CISA KEV
—
Not listed
SSVC (CISA ADP)
none
Automatable: yes / Impact: partial
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkNo authNo interaction
Confidentiality NIntegrity LAvailability L
This vulnerability may be exploitable over the internet without authentication or user interaction.
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | N | None |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | N | None |
| Integrity I | L | Low |
| Availability A | L | Low |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Description
NVD
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 3.1 | 6.5 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
| CNA / GitHub_M | 3.1 | 6.5 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| intranda | goobi-viewer-core | affected: < 26.05 |
Linux distribution status
References (3)
- https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef NVD, CNA x_refsource_MISC
- https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05 NVD, CNA x_refsource_MISC
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-gj5g-4rxf-8rmq NVD, CNA x_refsource_CONFIRM