{"id":"CVE-2026-46347","kind":"vulnerability","aliases":["CVE-2026-46347"],"related":[],"title":"Goobi viewer: predictable password reset passwords allow account takeover","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time. Exploiting this finding in isolation requires the victim to have triggered the reset themselves and the attacker to infer the server time from network or email metadata. This issue has been patched in version 26.05.","summary":"Goobi viewer, a web app for showing digitised material, generates replacement passwords during password reset with too little randomness. An attacker who can estimate the server's generation time may brute-force a reset password and log in as the victim.","severity":"medium","cvss":6.8,"epss":0.00427,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["goobi-viewer","java","runtime","self-hosted"],"not_affected_if":["password-reset-disabled","version-26.05-or-later"],"how_to_check":"- Check the installed Goobi viewer version; `unknown` if the sources do not say how to read it\n- Confirm whether the password reset feature is enabled on the instance","fix":"- Upgrade Goobi viewer to `26.05` or later\n- Unknown whether a workaround exists before upgrading","status":"open","published_at":"2026-10-23T15:17:31+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:42:36+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:42:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Goobi viewer to `26.05` or later\n- Unknown whether a workaround exists before upgrading","reach":"internet","title":"Goobi viewer: predictable password reset passwords allow account takeover","impact":"high","summary":"Goobi viewer, a web app for showing digitised material, generates replacement passwords during password reset with too little randomness. An attacker who can estimate the server's generation time may brute-force a reset password and log in as the victim.","category":"runtime","nicknames":[],"who_cares":["goobi-viewer","self-hosted","java"],"confidence":0.6,"needs_auth":"no","worst_case":"attacker takes over a user account by guessing its reset password","analyst_note":"Confirm the affected version range and whether the reset feature is on by default; the NVD entry gives no version check command.","how_to_check":"- Check the installed Goobi viewer version; `unknown` if the sources do not say how to read it\n- Confirm whether the password reset feature is enabled on the instance","needs_analyst":true,"not_affected_if":["version-26.05-or-later","password-reset-disabled"],"who_is_affected":"Instances of Goobi viewer before version 26.05 that let users reset passwords by email. Exploitation in isolation needs the victim to have requested the reset and the attacker to infer server timing from network or email metadata. Installations without the reset feature, or already on 26.05, are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000602,"input_tokens":3382,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-46347':12A,15A '26.05':87C,169C 'account':8A,110C 'allow':7A,74C,115C 'app':28B 'applic':72C,96C 'approxim':128C 'attack':44B,125C,151C 'browser':83C 'brute':55B,121C 'brute-forc':54B,120C 'cve':10A,13A 'digitis':31B,75C 'display':79C 'email':106C,160C 'entropi':114C 'estim':47B 'exploit':135C 'find':137C 'forc':56B,122C 'generat':33B,51B,97C,133C 'goobi':1A,17B,24B,67C 'goobi-view':16B 'holder':111C 'host':23B 'infer':153C 'insuffici':113C 'isol':139C 'issu':163C 'java':19B 'link':92C 'littl':41B 'log':61B 'materi':32B,76C 'may':53B 'metadata':161C 'network':158C 'password':4A,6A,35B,37B,59B,90C,100C,117C 'patch':166C 'predict':3A,103C 'prior':84C 'random':42B 'replac':34B,99C 'requir':140C 'reset':5A,38B,58B,91C,147C 'runtim':20B 'self':22B 'self-host':21B 'server':49B,131C,155C 'server-sid':130C 'show':30B 'side':132C 'takeov':9A 'time':52B,134C,156C 'trigger':145C 'version':86C,168C 'victim':65B,142C 'viewer':2A,18B,25B,68C 'visit':94C 'way':104C 'web':27B,71C,82C","nicknames":[],"mitigations":[],"who_affected":"Instances of Goobi viewer before version 26.05 that let users reset passwords by email. Exploitation in isolation needs the victim to have requested the reset and the attacker to infer server timing from network or email metadata. Installations without the reset feature, or already on 26.05, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-46347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46347","severity":null,"published_at":"2026-10-23T15:17:31+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-46347","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-46347","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}