Live › vulnerability › CVE-2026-55457
Go to dashboardWhen the webapi.authorization.token setting is absent, Goobi viewer's token check accepts an empty token value. An attacker can send a request with an empty token parameter to any protected web API endpoint and get through.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Goobi viewer instances older than 26.05 that do not set webapi.authorization.token are exposed, because the default token is the empty string and the filter accepts it. Instances that configure a non-empty token are not affected by this specific flaw. Teams running only managed or patched deployments can skip it.
No product ranges from the sources yet.
webapi.authorization.token is set in the Goobi viewer configuration file; if it is missing or blank, the instance is exposed.26.05 are affected.26.05 or later.webapi.authorization.token in the configuration as an interim measure.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.
This page as .md · .json · in your agent: get_signal("CVE-2026-55457")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.