CVE-2026-46347

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time. Exploiting this finding in isolation requires the victim to have triggered the reset themselves and the attacker to infer the server time from network or email metadata. This issue has been patched in version 26.05.

• CWE-330
• CWE-340
• CWE-640

• https://github.com/intranda/goobi-viewer-core/commit/1fa7a30a3a7699a82ea0df9c1a8997b2894d7841
• https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef
• https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05
• https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-hw9w-7r6g-2fjc

Published

Oct 23, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46341The Apify MCP server enables AI agents to extract data from …6.1
• CVE-2026-46342Nuxt is an open-source web development framework for Vue.js.…5.4
• CVE-2026-46343Wazuh is a free and open source platform used for threat pre…7.2
• CVE-2026-46344liboqs is a C-language cryptographic library that provides i…5.3
• CVE-2026-46345compliance-trestle is a tooling platform for managing compli…8.4
• CVE-2026-46346The Goobi viewer is a web application that allows digitised …6.5
• CVE-2026-46348Mastodon is a free, open-source social network server based …8.7
• CVE-2026-46349Mastodon is a free, open-source social network server based …5.3
• CVE-2026-4635Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4…5.3
• CVE-2026-46351BigBlueButton is an open-source virtual classroom. Prior to …8.1
• CVE-2026-46352Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-46353BigBlueButton is an open-source virtual classroom. Prior to …8.1