CVE-2026-55463
- Source
- https://cve.org/CVERecord?id=CVE-2026-55463
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55463.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55463
- Aliases
-
- GHSA-h5m9-fpvw-qr36
- Published
- 2026-10-23T14:17:06Z
- Modified
- 2026-10-31T07:03:11Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation
- Details
-
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) accept connections without verifying that the associated HttpSession belongs to a logged-in user, and none validate the Origin header against an allowlist. An unauthenticated attacker can therefore connect to these endpoints; through CampaignEndpoint this allows polluting the in-process crowdsourcing page-lock map and broadcasting forged lock messages, disrupting reviewers' work. This issue has been patched in version 26.05.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1385", "CWE-306", "CWE-862" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55463.json" }- References
-
- https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55463.json
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-h5m9-fpvw-qr36
- https://nvd.nist.gov/vuln/detail/CVE-2026-55463
- https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412
Affected packages
Git / github.com/intranda/goobi-viewer-core
Affected ranges
- Type
- GIT
- Repo
- https://github.com/intranda/goobi-viewer-core
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "4.11.0" }, { "fixed": "26.05" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "8714ca81065d2c2c6e614a1ee6753de65cbe3412" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v26.05", "range": [ { "fixed": "7e5e9de18c572c7b96f80efe01254bf08dc4cdb4" } ], "source": "REFERENCES_TAG" } ] }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55463.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"189669813573452456444402378749265863886",
"96469561279848577152133005639537992722",
"130479014063886990389788269767522989415",
"94139225538776199488222833643833438900",
"93573582772306912441064968980953276175",
"278482388510987088742494754009904738827",
"50863361577017617069895107017726543222",
"130269544618570183840243249247056085720",
"19211923499332401416184335792013532537",
"69295163308904141072758326625336241136",
"203859751780617765799070683020660972116"
],
"threshold": 0.9
},
"id": "CVE-2026-55463-01274e64",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/UserEndpoint.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "138782464526486670558280453558778584105",
"length": 155
},
"id": "CVE-2026-55463-07c81053",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/CampaignEndpoint.java",
"function": "onError"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"167394688334748627254747826039425229897",
"91113250503461770287734111721330166262",
"192889005515769196355724091889749291024",
"48885706923058075430255196971842501437",
"124506412653114569616344207894529328156"
],
"threshold": 0.9
},
"id": "CVE-2026-55463-1e97a032",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/test/java/io/goobi/viewer/websockets/DownloadTaskEndpointTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "218343067194433447228720390772099522514",
"length": 250
},
"id": "CVE-2026-55463-20adbe15",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/GetHttpSessionConfigurator.java",
"function": "modifyHandshake"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "43350417793947173165547334875970620546",
"length": 219
},
"id": "CVE-2026-55463-21922b04",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/UserEndpoint.java",
"function": "onOpen"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "187927923050240471897462225526665234311",
"length": 287
},
"id": "CVE-2026-55463-27aa2758",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/AutocompleteEndpoint.java",
"function": "onOpen"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "15972731808254145666261176205669785459",
"length": 2933
},
"id": "CVE-2026-55463-2ad86a12",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java",
"function": "getAdvancedSearchSelectItems"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "317383694876553427425481501677094544078",
"length": 285
},
"id": "CVE-2026-55463-39682a13",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/CampaignEndpoint.java",
"function": "onOpen"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"293943419837386175782308880630292377328",
"170127000326944715759514306120173437552",
"223072314872435556758862870822129730388",
"184713866145576581573500654664532882358",
"237588089203428832734919670992173305409",
"280990611135733430789396002312530922372",
"24011410402069477058498461939093920262",
"243679154761233145932008628234109855606",
"21245126937807009457669850870559185657",
"157573805690410280521963065924689943951",
"49299172231513956195727309028396980246",
"249794867519244567083176728280977870199",
"71331133885813258577251813447387200972",
"231280190624403314206933099108260677099",
"131064644070503162456003862872168843296",
"228717970448403275474455688186333628072",
"147229437546344567055115541779032048353",
"296771280783092075493187168226162854698",
"120686590177198208650842153671343843197",
"185110271319730517681325665849978046676",
"133072927174758095098837509638475082729",
"106915568864856288436707486586529388843",
"160461748305160759432425790653772593920",
"317668832181560233029467657143735579550",
"73682667438275365798270958473607512942",
"249449434883737352069413629640348278192",
"195647711537184443325539778426838681880",
"257419450339920369642547725144123517283",
"112254453685341924447530792146304337784",
"200506628299564351230936520852436132030",
"99422724347327295676833174058837105043",
"141225596712123407189091063186974358645",
"281192752199487692721550185112564389005",
"194840973750847596253923718843247966422",
"336380174445271318603843347024206517237",
"96952457555478317003593573357220284563",
"288939005615045911177043736404399404541",
"328674136467211459900128018005816102742",
"75851200508167515578606821188405267014",
"230110937255770512631639417010960709132",
"243367955632336005134513142238333853843",
"253728686788632627169401501763323725722",
"28196279546092511104474535655606889983",
"240985082911872732109250870253022523110",
"7405899224190688798808783959628142002",
"91368197618688457157980371544354479789",
"158697872569671941832991527465912955348",
"305106691200856417832257034142201370878",
"289336218389088023408326258965270312936",
"32131413311487982245812841291902270705",
"133528045941229369766499737505022324454",
"118600259359074066127455075675860467005",
"277131013592039677111080227322086714878",
"12132793595964136568255504321677124068",
"237513637503532782536650314870439478037",
"203609570456295320982548574336354293445",
"51906176174227463930981612168786621659",
"198425266314817376550601752740401743673",
"239541424654697691920923576302018587810",
"4477980581229884955895429889103133623",
"65554406765763519915522339427629544886"
],
"threshold": 0.9
},
"id": "CVE-2026-55463-46a7ca97",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"212724524529307037330830316033647618000",
"328391213367262815950685883982789969580",
"59402355423299906525944868265147336262",
"22303182926158190101553411926118659842",
"138216078896844418255898032608233903217",
"297413584697619051948628962295336833437",
"176908227494880128665329177559840609716",
"153675016924976758166007005213202671482",
"288690527470119013389424754516090411753"
],
"threshold": 0.9
},
"id": "CVE-2026-55463-52379d70",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/DownloadTaskEndpoint.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "245484018445154754926082606771929957652",
"length": 1046
},
"id": "CVE-2026-55463-6a3d1b53",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/test/java/io/goobi/viewer/websockets/CampaignEndpointTest.java",
"function": "setUp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"20828603898007908494117051062417382782",
"86656915863266030649259343751197216715",
"173444401774872092221789333771785812524"
],
"threshold": 0.9
},
"id": "CVE-2026-55463-87cd166f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/controller/Configuration.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"51812960223199776848683275929827197648",
"18160531736411674315499549948324003684",
"132060226440554826868222820054370357879",
"96916398206440173707895806901647358547",
"209376167411306502757569782354538852018",
"104555700186682893718892747541717502221",
"53791900818636487653306346252804783586",
"331702067870617004537778470344059501246",
"39166694764370414926304902580127277314",
"13920573432335361844847316637752813271",
"279807395425984716975706820673995749492",
"218028417639995920996532851704796348612",
"212327422733038012306987721012320736247",
"169577777919979641007741296629247738228",
"16898885532106034485560386629793953199",
"270178872457818182267786481521695507028",
"6936777129715788675344764243270074375",
"210587971100600811612045113052354943905",
"68240021322428294024419042819685285730",
"102398811905487963471404177784783038361"
],
"threshold": 0.9
},
"id": "CVE-2026-55463-89a85e61",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/test/java/io/goobi/viewer/websockets/CampaignEndpointTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "311035141633473691895566133501129668208",
"length": 803
},
"id": "CVE-2026-55463-8dcf1a36",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/LogViewerEndpoint.java",
"function": "onOpen"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"311647966031993027637447119760612333523",
"45042756095273116786299914397343082225",
"55148530043918451698533139725747167595",
"26586317873572193688067497051045011749",
"5656476598684706266163066236901487646",
"127937796835434512533485053205960440391",
"84340077183270547102229744575874257649",
"125813406002925888868846534389187885039",
"289286987488326553419926957369145967256",
"37264982382782170011929743832701837687"
],
"threshold": 0.9
},
"id": "CVE-2026-55463-bd7e880d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/GetHttpSessionConfigurator.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "93920389245523661630890965551004131242",
"length": 480
},
"id": "CVE-2026-55463-bfc5115f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/CampaignEndpoint.java",
"function": "setPageLock"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"88739587052296063926771489913657831000",
"272066656297377490341855294121500070498",
"67766915715831451237984867615896987700",
"139354470250700600932655400051018183732"
],
"threshold": 0.9
},
"id": "CVE-2026-55463-dd5cabec",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/AutocompleteEndpoint.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "312663887759026190073350179365692286750",
"length": 275
},
"id": "CVE-2026-55463-ddc84397",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/DownloadTaskEndpoint.java",
"function": "onOpen"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"178219165928834562851632370663247184040",
"87528328446094009976179740096906465588",
"290776235703126892371081843189878183891",
"56042785608781407400730111090794540445",
"312534274087111648700825956025332055858",
"15036206703488978222600028494733688268",
"59317414568934603025984257520357412565",
"35617330616381940676441145907024947257"
],
"threshold": 0.9
},
"id": "CVE-2026-55463-e97ba799",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/filters/CSRFRequestFilter.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"316369886973749787499641279678921733890",
"18395550459813733075661076927438043560",
"120550050803117529695309759665936926372",
"953496333816956825164376764335899582",
"280174422146835840350053232002540539256",
"88049337364874866960705211952887205730",
"112004011108022369375145309798208151749",
"282193752519845716317617727424151013177",
"65606710339648487349488061845373055594",
"312310252617611333265322937826434077675",
"230083546187009633457967132806209509841",
"116489553235202911881655894707902807872",
"12506761801128411842899008205876015791",
"145305119038375373834730527306434793172",
"275048037615705867960190446418889639798",
"340157025563382728042217196093950441865",
"278556798338719161112441328867586407588",
"106439665546975824025887564228554235006",
"308433242577278083608252190257265099174",
"306671991698021845697658477370226115289",
"175424046984854754087801945659354273506",
"183963823386245079632170431446494552635",
"174070636628366604213944620845712191102",
"5661485299215328874840212923645136156",
"33586761704943486927880412901464342269",
"185134059404577516800356788343112606501",
"142590076345077810909708713669994661739"
],
"threshold": 0.9
},
"id": "CVE-2026-55463-eb455810",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/CampaignEndpoint.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"237587860927492776512298495746418240248",
"333795448187885448591911525274832272252",
"158821531610500021766738320608900962147",
"66714893350697800833748391709705644500",
"262727779001649856060439731926061674503",
"226414360389554439928876932173523889076",
"43796508425396045094570053396539917696",
"134129018908304002028290434109590213080",
"287622085804374567790582712676813472035",
"326513629301010892461228005928993617904",
"177781176826994352119443252537138572226",
"138657732211632054568308308218630221949",
"300417146355252895149732419093656458140",
"132366097516602047414918204296977447575",
"125070284954377712757168075457268404211",
"205062727442510109970151465324980184722",
"118340621631835168216964744028950479925",
"252211063434731285724572426105698937086",
"235796216591841054091879903286222797324",
"97319617538237924816749796758187156480",
"334328141257312619580481029152682459337",
"98442634754925803808473826296095041918",
"36134729236468339048902370129342688276",
"32192757833741075589880275845586924065",
"89502768318206525562064961487810443392",
"192676590734310766045166016054898583997",
"220959680356930796315976143711536408660"
],
"threshold": 0.9
},
"id": "CVE-2026-55463-f14af923",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/LogViewerEndpoint.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"155893635994879177448900446549887256678",
"141173767962340893048862408021132947399",
"167276745848169275783907429468889603309"
],
"threshold": 0.9
},
"id": "CVE-2026-55463-f2d47ad6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412",
"target": {
"file": "goobi-viewer-core/src/test/java/io/goobi/viewer/controller/ConfigurationTest.java"
}
}
]
vanir_signatures_modified
"2026-10-31T07:03:11Z"