---
id: "CVE-2026-55457"
kind: "vulnerability"
aliases: ["CVE-2026-55457"]
title: "Goobi viewer: empty API token lets unauthenticated requests reach protected endpoints"
severity: "high"
cvss: 7.4
epss: 0.00456
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["goobi-viewer", "java", "package", "self-hosted"]
not_affected_if: ["patched-26.05", "token-configured"]
published_at: "2026-10-23T15:17:33+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55457", "first_seen_at": "2026-10-23T21:57:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-55457", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Goobi viewer: empty API token lets unauthenticated requests reach protected endpoints

When the webapi.authorization.token setting is absent, Goobi viewer's token check accepts an empty token value. An attacker can send a request with an empty token parameter to any protected web API endpoint and get through.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether `webapi.authorization.token` is set in the Goobi viewer configuration file; if it is missing or blank, the instance is exposed.
- Check the installed Goobi viewer version; versions before `26.05` are affected.

## Fix

- Upgrade Goobi viewer to `26.05` or later.
- Set a strong value for `webapi.authorization.token` in the configuration as an interim measure.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55457
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-55457

## From the sources

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_