Live › vulnerability › CVE-2026-55463
Go to dashboardSeveral Jakarta WebSocket endpoints in goobi-viewer-core accept connections without checking that the session belongs to a logged-in user, and they do not validate the Origin header. An unauthenticated attacker can pollute the crowdsourcing page-lock map and broadcast forged lock messages, disrupting reviewers' work.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Goobi viewer from version 4.11.0 up to but not including 26.05 are exposed, because the WebSocket endpoints are reachable without a login. Deployments on versions outside that range, or that are not reachable from the internet, have a smaller exposure; the sources do not say how the endpoints behave behind a reverse proxy.
No product ranges from the sources yet.
4.11.0 up to but not including 26.05 are affected.26.05 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) accept connections without verifying that the associated HttpSession belongs to a logged-in user, and none validate the Origin header against an allowlist. An unauthenticated attacker can therefore connect to these endpoints; through CampaignEndpoint this allows polluting the in-process crowdsourcing page-lock map and broadcasting forged lock messages, disrupting reviewers' work. This issue has been patched in version 26.05.
This page as .md · .json · in your agent: get_signal("CVE-2026-55463")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.