Live › vulnerability › CVE-2026-55486
Go to dashboardGoobi viewer versions 25.08 through 26.05 (before 26.05) take an unvalidated origin query parameter on the IIIF Auth 2.0 login and token endpoints and place it into a response header and an HTML script. An attacker can craft a link that runs JavaScript in a victim's browser on the Goobi viewer site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the deployed Goobi viewer version against 26.05; a version from 25.08 up to but not including 26.05 is affected.
Upgrade Goobi viewer to 26.05 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.
This page as .md · .json · in your agent: get_signal("CVE-2026-55486")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.