CVE-2026-55459: Goobi viewer: OpenID JWT audience not enforced by the verifier
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Goobi viewerto a version that resolves this vulnerability.Fixed in 26.05
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Goobi viewer versions 25.01 through versions before 26.05 are affected when OpenID authentication is used. The described attack scenario specifically requires a multi-relying-party identity-provider setup.
What does an attacker need to exploit the flaw?
An attacker needs an OpenID token whose single-string aud value matches the Goobi viewer client ID, even though the token was issued for a different relying party. If accepted, the viewer authenticates the attacker as the token subject.
Does this require an authenticated Goobi viewer account or user interaction?
No. The supplied vector lists no privileges required and no user interaction required. Exploitation depends on obtaining a suitable token and on the affected OpenID configuration.
What version fixes the problem?
Upgrade Goobi viewer to version 26.05, which patches the audience-validation issue.