Live › vulnerability › CVE-2026-46347
Go to dashboardGoobi viewer, a web app for showing digitised material, generates replacement passwords during password reset with too little randomness. An attacker who can estimate the server's generation time may brute-force a reset password and log in as the victim.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Instances of Goobi viewer before version 26.05 that let users reset passwords by email. Exploitation in isolation needs the victim to have requested the reset and the attacker to infer server timing from network or email metadata. Installations without the reset feature, or already on 26.05, are not affected.
No product ranges from the sources yet.
unknown if the sources do not say how to read it26.05 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time. Exploiting this finding in isolation requires the victim to have triggered the reset themselves and the attacker to infer the server time from network or email metadata. This issue has been patched in version 26.05.
This page as .md · .json · in your agent: get_signal("CVE-2026-46347")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.