CVE-2026-55457: Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Goobi viewerto a version that resolves this vulnerability.Fixed in 26.05
Event History
Frequently Asked Questions
Which deployments are exposed?
Goobi viewer deployments prior to version 26.05 are exposed if webapi.authorization.token is not configured. In that state, the token defaults to an empty string.
What does an attacker need to exploit the issue?
An attacker needs network access to a vulnerable Goobi viewer instance and can send a request to an endpoint protected by @AuthorizationBinding. No authentication or prior privileges are required; supplying an empty token parameter, ?token=, is accepted.
Are default or incomplete configurations affected?
Yes. The vulnerable condition occurs specifically when webapi.authorization.token is omitted, causing the application to treat an empty token as valid.
How can I check whether an instance is vulnerable?
Check the Goobi viewer version and whether webapi.authorization.token is configured. Versions before 26.05 with no configured token accept requests to protected endpoints when token is supplied as an empty value.
What is the available remediation?
Upgrade to Goobi viewer version 26.05, which patches the issue. Until upgrading, configure webapi.authorization.token with a non-empty value.