CVE-2026-46347
Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time. Exploiting this finding in isolation requires the victim to have triggered the reset themselves and the attacker to infer the server time from network or email metadata. This issue has been patched in version 26.05.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
| NVDNVD · Deferred | 3.1 | Medium6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.25% · top 83% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.
Weakness
- CWE-330: Use of Insufficiently Random Values (opens in a new tab)All about CWE-330 and its CVEs
- CWE-340: Generation of Predictable Numbers or Identifiers (opens in a new tab)All about CWE-340 and its CVEs
- CWE-640: Weak Password Recovery Mechanism for Forgotten Password (opens in a new tab)All about CWE-640 and its CVEs
Affected products
- affected < 26.05
References (4)
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-hw9w-7r6g-2fjc (opens in a new tab)x_refsource_CONFIRM
- https://github.com/intranda/goobi-viewer-core/commit/1fa7a30a3a7699a82ea0df9c1a8997b2894d7841 (opens in a new tab)x_refsource_MISC
- https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef (opens in a new tab)x_refsource_MISC
- https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-46347)Record last updated .