{"id":"CVE-2026-46346","kind":"vulnerability","aliases":["CVE-2026-46346"],"related":[],"title":"Goobi viewer: predictable password reset tokens allow account takeover","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.","summary":"Goobi viewer, a web app for displaying digitised material, generates password reset tokens predictably from the time of the request. An attacker who knows a user's email address can request a reset and brute-force the token to set a new password on that account.","severity":"medium","cvss":6.5,"epss":0.00464,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["goobi-viewer","java","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Goobi viewer version and compare it with `26.05`\n- unknown","fix":"- Upgrade Goobi viewer to `26.05` or later","status":"open","published_at":"2026-10-23T15:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:47:12+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:47:12Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Goobi viewer to `26.05` or later","reach":"internet","title":"Goobi viewer: predictable password reset tokens allow account takeover","impact":"high","summary":"Goobi viewer, a web app for displaying digitised material, generates password reset tokens predictably from the time of the request. An attacker who knows a user's email address can request a reset and brute-force the token to set a new password on that account.","category":"package","nicknames":[],"who_cares":["goobi-viewer","self-hosted","java"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over any user account by resetting its password","analyst_note":"Confirm the exact affected version range and whether the reset flow is on by default; the NVD entry gave no detail beyond the description.","how_to_check":"- Check the installed Goobi viewer version and compare it with `26.05`\n- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Any Goobi viewer deployment older than `26.05` that has password reset enabled for user accounts is exposed, since the reset flow is what lets an attacker brute-force the token. Deployments that disable password reset or use only external login (such as SSO) are less likely to be reachable this way, but the sources do not confirm the exact conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000577,"input_tokens":3333,"output_tokens":487,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-46346':12A,15A '26.05':92C,146C 'account':8A,70B,138C 'address':52B,115C 'allow':7A,79C 'alon':130C 'app':28B 'applic':77C 'attack':45B,108C 'base':99C 'browser':88C 'brute':59B,123C 'brute-forc':58B,122C 'cve':10A,13A 'digitis':31B,80C 'display':30B,84C 'email':51B,114C 'exploit':127C 'find':129C 'forc':60B,124C,131C 'generat':33B 'goobi':1A,17B,24B,72C 'goobi-view':16B 'host':23B 'issu':140C 'java':19B 'know':47B,110C 'materi':32B,81C 'new':66B 'packag':20B 'password':4A,34B,67B,94C,134C 'patch':143C 'predict':3A,37B,98C 'prior':89C 'request':43B,54B,106C,117C 'reset':5A,35B,56B,95C,105C,119C,135C 'self':22B 'self-host':21B 'set':64B 'takeov':9A 'target':112C 'time':40B,102C 'token':6A,36B,62B,96C,126C 'unauthor':133C 'user':49B 'version':91C,145C 'viewer':2A,18B,25B,73C 'web':27B,76C,87C","nicknames":[],"mitigations":[],"who_affected":"Any Goobi viewer deployment older than `26.05` that has password reset enabled for user accounts is exposed, since the reset flow is what lets an attacker brute-force the token. Deployments that disable password reset or use only external login (such as SSO) are less likely to be reachable this way, but the sources do not confirm the exact conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-46346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46346","severity":null,"published_at":"2026-10-23T15:17:31+00:00","modified_at":"2026-10-23T21:17:23+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-46346","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-46346","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}