Live › vulnerability › CVE-2026-46346
Go to dashboardGoobi viewer, a web app for displaying digitised material, generates password reset tokens predictably from the time of the request. An attacker who knows a user's email address can request a reset and brute-force the token to set a new password on that account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Goobi viewer deployment older than that has password reset enabled for user accounts is exposed, since the reset flow is what lets an attacker brute-force the token. Deployments that disable password reset or use only external login (such as SSO) are less likely to be reachable this way, but the sources do not confirm the exact conditions.
26.05No product ranges from the sources yet.
26.0526.05 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.
This page as .md · .json · in your agent: get_signal("CVE-2026-46346")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.