Live › vulnerability › CVE-2026-55459
Go to dashboardGoobi viewer accepts OpenID tokens issued for a different relying party when the audience is a single string matching its client ID, because the audience check is incomplete. An attacker holding such a token from a shared identity provider can sign in as the token's subject.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments running Goobi viewer from 25.01 before that log users in through OpenID Connect against an identity provider shared with other relying parties are exposed. Installations without OpenID login, or with a dedicated identity provider that issues tokens only for the viewer, are less exposed; the sources do not say more.
26.05No product ranges from the sources yet.
25.01 and 26.05.26.05 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.
This page as .md · .json · in your agent: get_signal("CVE-2026-55459")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.