{"id":"CVE-2026-55486","published":"2026-10-23T15:17:33.657","lastModified":"2026-10-23T16:28:32.357","description":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79","CWE-113","CWE-1336"],"vendors":[],"products":[],"references":[{"url":"https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b","tags":[]},{"url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05","tags":[]},{"url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-975w-g9gj-xq48","tags":[]}],"exploitRefs":[{"url":"https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b","tags":[]},{"url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05","tags":[]},{"url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-975w-g9gj-xq48","tags":[]}],"hasPoc":true,"ai":{"summary":"The Goobi viewer's IIIF Auth 2.0 endpoints accept an unvalidated 'origin' query parameter and embed it into both a Content-Security-Policy header and an HTML response body as an unescaped JavaScript string, leading to reflected XSS when an attacker tricks a user into visiting a crafted URL.","exploitability":"Exploitation requires social engineering (e.g., phishing) to诱导 the victim to click a malicious link, as user interaction is needed to trigger the reflected XSS.","blast_radius":"Successful exploitation could allow attackers to steal session tokens, perform actions on behalf of the user, or exfiltrate sensitive digitized content displayed in the viewer.","remediation":"Upgrade to Goobi viewer version 26.05 or later, which patches the unvalidated origin parameter handling.","detection":"Look for HTTP responses containing a Content-Security-Policy header with a frame-ancestors directive derived from an unexpected or attacker-controlled origin value, and/or HTML responses embedding unescaped origin values in JavaScript string literals.","tags":["xss","web-app","csp-bypass","reflected-xss","iiif"],"model":"garnet-coder","analyzedAt":"2026-10-25T08:49:09.866Z"}}