CVE-2026-46347: Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

Q: Who is realistically exposed to this issue?

Goobi viewer deployments running versions earlier than 26.05 are affected. Exploitation also depends on a user having initiated a password reset.

Q: What does an attacker need to exploit the predictable replacement password?

The attacker must approximate the server-side time at which the replacement password was generated. Network timing information or email metadata may help infer that time, and the victim must have triggered the reset.

Q: Is a password reset request alone enough for exploitation?

No. The attacker must also be able to narrow down the password-generation time sufficiently to brute-force the predictable replacement password.

Q: What should be done to remediate the issue?

Upgrade Goobi viewer to version 26.05, which includes the patch.

Published Oct 23, 2026

Updated

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time. Exploiting this finding in isolation requires the victim to have triggered the reset themselves and the attacker to infer the server time from network or email metadata. This issue has been patched in version 26.05.

Affected Software

1 affected component

Goobi Goobi viewer<26.05

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Goobi viewer to a version that resolves this vulnerability.
Fixed in 26.05

Event History

Oct 23, 2026

CVE Published

via MITRE·02:14 PM

Data Sourced

via MITRE·02:14 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Goobi viewer deployments running versions earlier than 26.05 are affected. Exploitation also depends on a user having initiated a password reset.

What does an attacker need to exploit the predictable replacement password?

The attacker must approximate the server-side time at which the replacement password was generated. Network timing information or email metadata may help infer that time, and the victim must have triggered the reset.

Is a password reset request alone enough for exploitation?

No. The attacker must also be able to narrow down the password-generation time sufficiently to brute-force the predictable replacement password.

What should be done to remediate the issue?

Upgrade Goobi viewer to version 26.05, which includes the patch.

CVE-2026-46347: Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the predictable replacement password?

Is a password reset request alone enough for exploitation?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the predictable replacement password?

Is a password reset request alone enough for exploitation?

What should be done to remediate the issue?