◆ CVE Hub

CVE-2026-55463

Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

Published
2026-10-23
Last modified
2026-10-23
CNA
GitHub_M
NVD status
Deferred
CWE
CWE-306 CWE-862 CWE-1385

Fetching some sources has been requested. Reload in about a minute to see them.

CVSS v3.1 (listed by NVD)
6.5
MEDIUM
Scored by github.com (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
6.5
MEDIUM
Scored by CNA (GitHub_M) · v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS exploit probability
0.2%
Percentile 8.7%
as of 2026-10-24
CISA KEV
—
Not listed

Attack conditions and impact

Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkNo authNo interaction Confidentiality LIntegrity LAvailability N

This vulnerability may be exploitable over the internet without authentication or user interaction.

MetricValueMeaning
Attack vector AVNNetwork
Attack complexity ACLLow (easy)
Privileges required PRNNone
User interaction UINNone
Scope SUUnchanged
Confidentiality CLLow
Integrity ILLow
Availability ANNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

NVD

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) accept connections without verifying that the associated HttpSession belongs to a logged-in user, and none validate the Origin header against an allowlist. An unauthenticated attacker can therefore connect to these endpoints; through CampaignEndpoint this allows polluting the in-process crowdsourcing page-lock map and broadcasting forged lock messages, disrupting reviewers' work. This issue has been patched in version 26.05.

CVSS assessments

ProviderVersionScoreVector
NVD / [email protected] (Secondary)3.16.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA / GitHub_M3.16.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products and packages

CNA (CVE.org)

VendorProductVersions
intrandagoobi-viewer-core
affected: >= 4.11.0, < 26.05

Linux distribution status

Red Hat ↗ Fetching

Debian ↗

No record

Ubuntu ↗ Fetching

References (3)