PT-2026-122124

CVE-2026-46346

Published

2026-10-23

Updated

2026-10-23

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Goobi viewer versions prior to 26.05

Description The Goobi viewer is a web application used for displaying digitized material in web browsers. The application generates password reset tokens based predictably on the time the reset request is made. An attacker with knowledge of a target's email address can request a reset and brute-force the token to perform an unauthorized password reset on any account.

Recommendations Update to version 26.05.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-330: Use of Insufficiently Random Values

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

CWE-340: Generation of Predictable Numbers or Identifiers

Related identifiers