CVE-2026-55486: Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Goobi viewerto a version that resolves this vulnerability.Fixed in 26.05
Event History
Frequently Asked Questions
Which deployments are affected?
Goobi viewer versions 25.08 through versions before 26.05 are affected. Version 26.05 contains the patch.
What does an attacker need to exploit this issue?
The attacker needs to cause a user to interact with a crafted request to the IIIF Auth 2.0 auth/login or auth/token endpoint. No attacker privileges are required, but user interaction is required.
What is the impact of a successful exploit?
A crafted origin parameter can produce reflected cross-site scripting in the authentication flow. The vulnerability can also malform the Content-Security-Policy frame-ancestors header, and the stated impact includes high confidentiality and integrity effects.
Which input should be reviewed or restricted if updating is not immediately possible?
The affected input is the origin query parameter accepted by the IIIF Auth 2.0 auth/login and auth/token endpoints in AuthorizationFlowResource. A temporary mitigation should prevent untrusted origin values from reaching these endpoints.