Goobi viewer Core: Reflected XSS via unvalidated IIIF Auth 2.0 origin parameter
Summary
The IIIF Auth 2.0 login and token endpoints of Goobi viewer Core accept an origin parameter without validation and reflect it into the Content-Security-Policy header and a JavaScript string in the HTML response. An attacker can craft a link that runs script in the viewer's origin. Exploitation requires a victim to open the crafted link or frame it, which can give access to the victim's authenticated session and actions in their name.
Affected
- intranda Goobi viewer Core (io.goobi.viewer:viewer-core) from 25.08 up to, but not including, 26.05
- Vendor range as published in the GitHub advisory and CNA record
Fixed in
- Upgrade to version 26.05 or later
- No backport to older branches is known.
Workaround
- Reverse proxy with X-Frame-Options DENY and frame-ancestors 'self' blocks cross-origin iframe delivery and neutralises the CSP header malformation; this is a partial measure only, as top-level navigation to a crafted link is not blocked.
- Optionally restrict requests with origin parameters to the auth/login and auth/token paths at the WAF (not tested, not from a vendor source).
Exploitation
- No public proof of concept known.
- Not known to be exploited in the wild; not listed in the CISA KEV catalog.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether Goobi viewer is in use and which version is running.
- If version 25.08 to 26.04 is in use, plan and perform an upgrade to 26.05 or later.
- Until the upgrade, apply the reverse-proxy headers and restrict auth endpoint requests with origin parameters.
- Monitor web logs for unusual requests to the auth/login and auth/token endpoints.
- Note the score spread: CNA 9.3, VulDB 4.3. Assess together with other same-day Goobi viewer advisories if the product is deployed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-975w-g9gj-xq48 github.com
- Fix commit 0e488c6b github.com
- Release v26.05 github.com
- Vulners CNA record CVELIST:CVE-2026-55486 vulners.com
- VulDB CVE-2026-55486 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:46.
Original description (NVD)
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.