CVE-2026-55486
- Source
- https://cve.org/CVERecord?id=CVE-2026-55486
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55486.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55486
- Aliases
-
- GHSA-975w-g9gj-xq48
- Published
- 2026-10-23T14:17:42Z
- Modified
- 2026-11-01T07:03:42Z
- Severity
-
- 9.3 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
- Summary
- Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
- Details
-
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-113", "CWE-1336", "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55486.json" }- References
-
- https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55486.json
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-975w-g9gj-xq48
- https://nvd.nist.gov/vuln/detail/CVE-2026-55486
- https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b
Affected packages
Git / github.com/intranda/goobi-viewer-core
Affected ranges
- Type
- GIT
- Repo
- https://github.com/intranda/goobi-viewer-core
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "25.08" }, { "fixed": "26.05" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v26.05", "range": [ { "fixed": "7e5e9de18c572c7b96f80efe01254bf08dc4cdb4" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
v25.*
v25.08
v25.08.1
v25.09
v25.09.1
v25.09.2
v25.09.3
v25.09.4
v25.09.5
v25.10
v25.10.1
v25.10.2
v25.10.3
v25.10.4
v25.10.6
v25.10.7
v25.10.8
v26.*
v26.01
v26.01.1
v26.02
v26.02.1
v26.02.2
v26.02.3
v26.02.4
v26.03
v26.03.1
v26.03.2
v26.03.3
v26.03.4
v26.03.5
v26.03.6
v26.03.7
v26.03.8
v26.04
v26.04.1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55486.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "15972731808254145666261176205669785459",
"length": 2933
},
"id": "CVE-2026-55486-2ad86a12",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java",
"function": "getAdvancedSearchSelectItems"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"293943419837386175782308880630292377328",
"170127000326944715759514306120173437552",
"223072314872435556758862870822129730388",
"184713866145576581573500654664532882358",
"237588089203428832734919670992173305409",
"280990611135733430789396002312530922372",
"24011410402069477058498461939093920262",
"243679154761233145932008628234109855606",
"21245126937807009457669850870559185657",
"157573805690410280521963065924689943951",
"49299172231513956195727309028396980246",
"249794867519244567083176728280977870199",
"71331133885813258577251813447387200972",
"231280190624403314206933099108260677099",
"131064644070503162456003862872168843296",
"228717970448403275474455688186333628072",
"147229437546344567055115541779032048353",
"296771280783092075493187168226162854698",
"120686590177198208650842153671343843197",
"185110271319730517681325665849978046676",
"133072927174758095098837509638475082729",
"106915568864856288436707486586529388843",
"160461748305160759432425790653772593920",
"317668832181560233029467657143735579550",
"73682667438275365798270958473607512942",
"249449434883737352069413629640348278192",
"195647711537184443325539778426838681880",
"257419450339920369642547725144123517283",
"112254453685341924447530792146304337784",
"200506628299564351230936520852436132030",
"99422724347327295676833174058837105043",
"141225596712123407189091063186974358645",
"281192752199487692721550185112564389005",
"194840973750847596253923718843247966422",
"336380174445271318603843347024206517237",
"96952457555478317003593573357220284563",
"288939005615045911177043736404399404541",
"328674136467211459900128018005816102742",
"75851200508167515578606821188405267014",
"230110937255770512631639417010960709132",
"243367955632336005134513142238333853843",
"253728686788632627169401501763323725722",
"28196279546092511104474535655606889983",
"240985082911872732109250870253022523110",
"7405899224190688798808783959628142002",
"91368197618688457157980371544354479789",
"158697872569671941832991527465912955348",
"305106691200856417832257034142201370878",
"289336218389088023408326258965270312936",
"32131413311487982245812841291902270705",
"133528045941229369766499737505022324454",
"118600259359074066127455075675860467005",
"277131013592039677111080227322086714878",
"12132793595964136568255504321677124068",
"237513637503532782536650314870439478037",
"203609570456295320982548574336354293445",
"51906176174227463930981612168786621659",
"198425266314817376550601752740401743673",
"239541424654697691920923576302018587810",
"4477980581229884955895429889103133623",
"65554406765763519915522339427629544886"
],
"threshold": 0.9
},
"id": "CVE-2026-55486-46a7ca97",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "217564182671257611328788095084106724081",
"length": 834
},
"id": "CVE-2026-55486-7e4dda73",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v2/auth/AuthorizationFlowResource.java",
"function": "loginService"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "224339381220018724517199017011283252632",
"length": 363
},
"id": "CVE-2026-55486-d4ef7ac1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v2/auth/AuthorizationFlowResource.java",
"function": "getTokenServiceResponseBody"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "182402293228250217037059672687716565478",
"length": 1494
},
"id": "CVE-2026-55486-e245c114",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v2/auth/AuthorizationFlowResource.java",
"function": "accessTokenService"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"81083066986560238691008379660189218013",
"267284321959349482084159495796835272758",
"16265764325371146789490231099189842025",
"42496812359593404023306303615841588684",
"215725964946134855770870371725769379787",
"293239867460488088726989089446687900882",
"229575010011859010217060585500110615235",
"106055999154384710828492079003405144065",
"162470821046664910243473751704207716579",
"137135931348350916942325359779543558162",
"304903526987538409496227142321303327184",
"161936341964033348672286770833362989218",
"47845620073602340873466432325502923400",
"58880347090472746890754974871320102632",
"295598217488265295302643601340222341146",
"259925561666455719263329987893343924921",
"73877677303247437165086307749672891797",
"1142803456500026777877583701044675989",
"249954026306405799150696282647674494104",
"159718661643596565619322772422355462892",
"182498516234065793114477487713271614849",
"281513286071723232357616088300215858816",
"54931801689568200676251500705391485227",
"27229270251459756043049864785923879684",
"274312714102680048531793786342442698137",
"133807095659798922812834514649166381331",
"178600989480196910965751553877446248434",
"140168774205994088416535837202370831094",
"91993370650319353925181766610297613427",
"54545773689475212334801237811245479488",
"156122567138616920202758862630969712863",
"40537156697980705455141864072854190312",
"292817711966160744296818623514109475594",
"286971520813027058548463807381344649899",
"290905718224309850962242703768575117178",
"182796943300830901894686977003252735874",
"209979394113446481115362963410886947619",
"117740843996648444948447569204347908490",
"252903322302013520781791296179115183324",
"253460158362983609023549653637837497497",
"216420792613743914566303535019293413778",
"167410467791386952728353667894475932811",
"52368217119520806132598299752014409708",
"72253753042429298332192483891234314058",
"259745422557890366620008756452860708340",
"90401530538944457527372014815395594009",
"18740449959003676133843487816364843700",
"288277773206657949367474460220549146553",
"144082048129026669541898551920937764113",
"34490189220298921439801534328894577777",
"291497306396367651302411254816186127823",
"187610784270789423864865039383465671402",
"39700972574131112427265714238613167530",
"2183607547490554861638445710766890044",
"52613038688732248853296045236245842014",
"226611411886721185712791166233802335096",
"298462450054095135317765765665332351832",
"237417110459845303843258505918549620206",
"199775475900087735723571435194305648958",
"240624156986883404081278635869033781825",
"11611970794144237132074185915853317586",
"222224555075092866581175230796724356091",
"232229124209385286855459355961006626795",
"119872902849994114282709568006188074860",
"167254424726201729619754415965492405683",
"151566484692135911986790415118320806394",
"105876680166622138267942819680036041436",
"151810807019191775553258894358385391585",
"160516004798529977938384959685637063838",
"272736239945361682747151151699886134961",
"168162948987106352313964947792282822489",
"235435941663578290828150806977522242871",
"315357763160317795430524983174533153359",
"153459171112309766319071844637911848550",
"45829029471833550118698457012233188770",
"177918851746991147953043765378848405467",
"266356282406086200620809027949135540116",
"286751658172588082338384253139547321565",
"191926809113802116213795213402804579621",
"309738650105929614123104067918471776819",
"252713045120867603397134791278046353730",
"329146400423205630246567951206446946088",
"79960783409093227323799811696970298566",
"272736239945361682747151151699886134961",
"168162948987106352313964947792282822489"
],
"threshold": 0.9
},
"id": "CVE-2026-55486-f26cd431",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b",
"target": {
"file": "goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v2/auth/AuthorizationFlowResource.java"
}
}
]
vanir_signatures_modified
"2026-11-01T07:03:42Z"