{"id":"CVE-2026-55459","kind":"vulnerability","aliases":["CVE-2026-55459"],"related":[],"title":"Goobi viewer: OpenID token audience not enforced, allowing account takeover","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.","summary":"Goobi viewer accepts OpenID tokens issued for a different relying party when the audience is a single string matching its client ID, because the audience check is incomplete. An attacker holding such a token from a shared identity provider can sign in as the token's subject.","severity":"high","cvss":7.4,"epss":0.00241,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["goobi-viewer","java","openid-connect","package","self-hosted"],"not_affected_if":["default-config","no-openid-login"],"how_to_check":"- Check the Goobi viewer version deployed, for example in the application's pom.xml or the running build, and confirm whether it is between `25.01` and `26.05`.\n- Check whether the viewer uses OpenID login against an identity provider that also serves other relying parties.","fix":"- Upgrade Goobi viewer to `26.05` or later.","status":"open","published_at":"2026-10-23T15:17:33+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T03:25:32+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:25:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Goobi viewer to `26.05` or later.","reach":"internet","title":"Goobi viewer: OpenID token audience not enforced, allowing account takeover","impact":"high","summary":"Goobi viewer accepts OpenID tokens issued for a different relying party when the audience is a single string matching its client ID, because the audience check is incomplete. An attacker holding such a token from a shared identity provider can sign in as the token's subject.","category":"package","nicknames":[],"who_cares":["goobi-viewer","self-hosted","openid-connect","java"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker signs in as another user via a token meant for another app","analyst_note":"Confirm the affected version range and whether a dedicated advisory or the patch commit names exact tokens and configuration; the NVD entry alone does not list affected deployment conditions beyond multi-RP IdP.","how_to_check":"- Check the Goobi viewer version deployed, for example in the application's pom.xml or the running build, and confirm whether it is between `25.01` and `26.05`.\n- Check whether the viewer uses OpenID login against an identity provider that also serves other relying parties.","needs_analyst":true,"not_affected_if":["default-config","no-openid-login"],"who_is_affected":"Deployments running Goobi viewer from `25.01` before `26.05` that log users in through OpenID Connect against an identity provider shared with other relying parties are exposed. Installations without OpenID login, or with a dedicated identity provider that issues tokens only for the viewer, are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":3434,"output_tokens":591,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-55459':13A,16A '25.01':95C '26.05':99C,189C 'accept':30B 'account':9A 'afterward':126C 'algorithm':106C 'allow':8A,83C 'applic':81C 'attack':57B,176C 'aud':115C,121C,140C,155C 'audienc':5A,41B,52B 'authent':174C 'authenticationendpoint.verifyopenidtoken':100C 'browser':92C 'build':101C,109C 'call':133C 'check':53B,122C,172C 'claim':116C 'client':48B,160C 'connect':23B 'cryptograph':118C 'cve':11A,14A 'differ':36B,167C 'digitis':84C 'display':88C 'enforc':7A,113C 'equal':132C 'goobi':1A,18B,28B,76C 'goobi-view':17B 'handl':136C 'hold':58B 'host':27B 'id':49B,161C 'ident':65B 'idp':147C 'incomplet':55B 'issu':33B,164C,183C 'issuer':108C 'java':20B 'jwt.require':105C 'manual':125C 'match':46B,156C 'materi':85C 'multi':145C 'multi-rp':144C 'openid':3A,22B,31B 'openid-connect':21B 'packag':24B 'parti':38B,169C 'pass':170C 'patch':186C 'perform':124C 'provid':66B 'reli':37B,168C 'rp':146C 'self':26B 'self-host':25B 'setup':148C 'share':64B 'sign':68B 'singl':44B,129C,138C,153C 'single-str':137C,152C 'string':45B,131C,139C,154C 'string-equ':130C 'sub':181C 'subject':74B 'takeov':10A 'token':4A,32B,61B,72B,150C,179C 'valid':119C 'valu':141C 'verifi':103C 'version':94C,98C,188C 'via':127C 'viewer':2A,19B,29B,77C,158C 'web':80C,91C 'whose':151C 'withissu':107C","nicknames":[],"mitigations":[],"who_affected":"Deployments running Goobi viewer from `25.01` before `26.05` that log users in through OpenID Connect against an identity provider shared with other relying parties are exposed. Installations without OpenID login, or with a dedicated identity provider that issues tokens only for the viewer, are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55459","severity":null,"published_at":"2026-10-23T15:17:33+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-55459","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-55459","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}