Vulnerability · Published Oct 23, 2026 · Assigned by GitHub_M

CVE-2026-46346Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

Medium 6.5

In plain English

A medium-severity weak randomness in goobi-viewer-core from intranda. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 73.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.

Affected products (as reported)

Vendor	Product	Versions
intranda	goobi-viewer-core	< 26.05

Weakness: CWE-330, CWE-340, CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-gj5g-4rxf-8rmq x_refsource_CONFIRM
https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef x_refsource_MISC
https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05 x_refsource_MISC