---
id: "CVE-2026-55486"
kind: "vulnerability"
aliases: ["CVE-2026-55486"]
title: "Goobi viewer: IIIF auth endpoints let attackers inject script via origin parameter"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["goobi-viewer", "java", "runtime", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-23T15:17:33+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-23T22:30:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55486", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# Goobi viewer: IIIF auth endpoints let attackers inject script via origin parameter

Goobi viewer versions 25.08 through 26.05 (before 26.05) take an unvalidated origin query parameter on the IIIF Auth 2.0 login and token endpoints and place it into a response header and an HTML script. An attacker can craft a link that runs JavaScript in a victim's browser on the Goobi viewer site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the deployed Goobi viewer version against 26.05; a version from 25.08 up to but not including 26.05 is affected.

## Fix

Upgrade Goobi viewer to 26.05 or later.

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55486

## From the sources

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_