CVE-2026-46347 in goobi-viewer-core
Summary
by MITRE • 10/23/2026
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time. Exploiting this finding in isolation requires the victim to have triggered the reset themselves and the attacker to infer the server time from network or email metadata. This issue has been patched in version 26.05.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Goobi viewer is a widely used web application designed for displaying digitized cultural heritage materials, such as books, manuscripts, and images, within standard web browsers. As with any system managing user accounts and sensitive digital assets, the integrity of authentication mechanisms is paramount to preventing unauthorized access. Prior to version 26.05, the password reset functionality contained a critical cryptographic weakness that undermined the security of account recovery processes. This vulnerability stems from an insufficient entropy in the generation algorithm used for temporary replacement passwords. Instead of utilizing a cryptographically secure random number generator with high entropy, the application employed a predictable method for creating these tokens. This flaw allows an attacker to potentially guess or brute-force the reset password if they can approximate the server-side time at which the token was generated.
The technical nature of this vulnerability aligns closely with CWE-330: Use of Insufficiently Random Values, and falls under the broader category of CWE-640: Weak Password Recovery Mechanisms for Administrators. The core issue lies in the deterministic or semi-deterministic generation of reset tokens based on temporal data rather than true randomness. When a user initiates a password reset, the system generates a token and emails it to the associated account holder. Because the generation logic relies heavily on server time with limited additional randomization factors, the resulting password space is significantly reduced compared to standard secure implementations. An attacker who can observe network timing or email delivery metadata may be able to narrow down the window of possible generation times. By combining this temporal approximation with knowledge of the algorithm's structure, an attacker could theoretically perform a brute-force attack against the limited set of potential passwords generated within that time frame.
Exploiting this vulnerability in isolation requires specific conditions and user interaction. The victim must first trigger the password reset process themselves, which provides the attacker with the target account and initiates the generation of the vulnerable token. Furthermore, the attacker must possess some ability to infer or estimate the server's internal clock at the moment of token creation. This could be achieved through various side-channel observations, such as analyzing timestamps in email headers, network packet captures, or other metadata that correlates with the request processing time. Once these conditions are met, the low entropy of the generated password allows for a feasible brute-force attack to recover the temporary credentials. It is important to note that this vulnerability does not allow for direct remote code execution or immediate unauthorized access without prior user action and environmental reconnaissance by the attacker.
The operational impact of this flaw centers on account takeover potential if an adversary successfully guesses the reset token. Successful exploitation could lead to unauthorized access to the victim's Goobi viewer account, potentially exposing sensitive digitized materials that may be restricted to authenticated users only. In contexts where these digital collections contain proprietary or personally identifiable information, such a breach could result in significant data exposure and compliance violations. Additionally, if administrative accounts are compromised through this method, an attacker could gain control over the entire platform, allowing for further exploitation of other vulnerabilities within the application ecosystem. The risk is particularly acute in environments where strict access controls are enforced on digital assets, as the compromise of a single account might serve as a foothold for broader system infiltration.
Mitigation strategies primarily involve upgrading to version 26.05 or later, which addresses this issue by implementing robust cryptographic random number generation for password reset tokens. Organizations running older versions should prioritize immediate patching to eliminate this attack vector. In the interim, if upgrading is not immediately feasible, administrators can implement additional controls such as rate limiting on password reset requests to slow down brute-force attempts and enforce strict time-to-live policies that expire reset tokens rapidly after issuance. Furthermore, enhancing monitoring for unusual patterns in authentication logs may help detect attempted exploitation activities. Security teams should also ensure that all user-facing applications follow industry best practices for credential management, including the use of cryptographically secure pseudorandom number generators as recommended by standards such as NIST SP 800-63B regarding digital identity guidelines. Regular security assessments and penetration testing can help identify similar weaknesses in other authentication flows before they are exploited in production environments.