{"id":"CVE-2026-55457","kind":"vulnerability","aliases":["CVE-2026-55457"],"related":[],"title":"Goobi viewer: empty API token lets unauthenticated requests reach protected endpoints","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.","summary":"When the webapi.authorization.token setting is absent, Goobi viewer's token check accepts an empty token value. An attacker can send a request with an empty token parameter to any protected web API endpoint and get through.","severity":"high","cvss":7.4,"epss":0.00456,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["goobi-viewer","java","package","self-hosted"],"not_affected_if":["patched-26.05","token-configured"],"how_to_check":"- Check whether `webapi.authorization.token` is set in the Goobi viewer configuration file; if it is missing or blank, the instance is exposed.\n- Check the installed Goobi viewer version; versions before `26.05` are affected.","fix":"- Upgrade Goobi viewer to `26.05` or later.\n- Set a strong value for `webapi.authorization.token` in the configuration as an interim measure.","status":"open","published_at":"2026-10-23T15:17:33+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:25:33+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:25:33Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Goobi viewer to `26.05` or later.\n- Set a strong value for `webapi.authorization.token` in the configuration as an interim measure.","reach":"internet","title":"Goobi viewer: empty API token lets unauthenticated requests reach protected endpoints","impact":"medium","summary":"When the webapi.authorization.token setting is absent, Goobi viewer's token check accepts an empty token value. An attacker can send a request with an empty token parameter to any protected web API endpoint and get through.","category":"package","nicknames":[],"who_cares":["goobi-viewer","self-hosted","java"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated callers reach protected web API endpoints with an empty token","analyst_note":"","how_to_check":"- Check whether `webapi.authorization.token` is set in the Goobi viewer configuration file; if it is missing or blank, the instance is exposed.\n- Check the installed Goobi viewer version; versions before `26.05` are affected.","needs_analyst":false,"not_affected_if":["token-configured","patched-26.05"],"who_is_affected":"Goobi viewer instances older than 26.05 that do not set webapi.authorization.token are exposed, because the default token is the empty string and the filter accepts it. Instances that configure a non-empty token are not affected by this specific flaw. Teams running only managed or patched deployments can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000602,"input_tokens":3367,"output_tokens":531,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-55457':14A,17A '26.05':82C,135C 'absent':31B 'accept':37B,127C 'allow':69C 'api':4A,57B 'applic':67C 'attack':43B 'authorizationbind':117C 'authorizationbinding-protect':116C 'authorizationfilt':93C 'browser':78C 'check':36B,103C 'compar':94C 'configur':92C,106C 'configuration.getwebapitoken':83C 'cve':12A,15A 'default':100C 'digitis':70C 'display':74C 'empti':3A,39B,50B,86C,111C,122C 'endpoint':11A,58B,119C 'first':102C 'get':60B 'goobi':1A,19B,32B,62C 'goobi-view':18B 'host':25B 'issu':129C 'java':21B 'let':6A 'materi':71C 'non':110C 'non-empti':109C 'packag':22B 'paramet':52B 'patch':132C 'prior':79C 'protect':10A,55B,118C 'reach':9A 'request':8A,47B,113C 'return':84C 'self':24B 'self-host':23B 'send':45B 'set':29B 'string':87C 'suppli':96C 'therefor':126C 'token':5A,35B,40B,51B,97C,107C,123C 'unauthent':7A 'valu':41B,124C 'version':81C,134C 'viewer':2A,20B,33B,63C 'web':56B,66C,77C 'webapi.authorization.token':28B,89C 'without':101C","nicknames":[],"mitigations":[],"who_affected":"Goobi viewer instances older than 26.05 that do not set webapi.authorization.token are exposed, because the default token is the empty string and the filter accepts it. Instances that configure a non-empty token are not affected by this specific flaw. Teams running only managed or patched deployments can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55457","severity":null,"published_at":"2026-10-23T15:17:33+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-55457","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55457","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}