CVE-2026-46346: Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

Q: Which deployments are affected?

Goobi viewer versions prior to 26.05 are affected. Version 26.05 contains the patch.

Q: What does an attacker need to exploit this issue?

An attacker needs to know the target account's email address. They can request a password reset and brute-force the token because it is predictably based on the reset-request time.

Q: Is authentication or user interaction required?

No. The vulnerability is rated with no privileges required and no user interaction required.

Q: What is the direct impact of successful exploitation?

Exploitation alone can force an unauthorized password reset for any account. The stated impacts are low integrity and low availability impact, with no confidentiality impact.

Published Oct 23, 2026

Updated

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.

Affected Software

1 affected component

Goobi Goobi viewer<26.05

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Goobi viewer to a version that resolves this vulnerability.
Fixed in 26.05

Event History

Oct 23, 2026

CVE Published

via MITRE·02:14 PM

Data Sourced

via MITRE·02:14 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Goobi viewer versions prior to 26.05 are affected. Version 26.05 contains the patch.

What does an attacker need to exploit this issue?

An attacker needs to know the target account's email address. They can request a password reset and brute-force the token because it is predictably based on the reset-request time.

Is authentication or user interaction required?

No. The vulnerability is rated with no privileges required and no user interaction required.

What is the direct impact of successful exploitation?

Exploitation alone can force an unauthorized password reset for any account. The stated impacts are low integrity and low availability impact, with no confidentiality impact.

CVE-2026-46346: Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Is authentication or user interaction required?

What is the direct impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Is authentication or user interaction required?

What is the direct impact of successful exploitation?