{"id":"CVE-2026-46346","summary":"Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset","details":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password reset token is predictably based on the time of the reset request. An attacker who knows the target's email address can request a reset and then brute-force the token. Exploiting this finding alone forces an unauthorized password reset on any account. This issue has been patched in version 26.05.","aliases":["GHSA-gj5g-4rxf-8rmq"],"modified":"2026-10-28T11:01:09.162505514Z","published":"2026-10-23T14:14:39.197Z","database_specific":{"cwe_ids":["CWE-330","CWE-340","CWE-640"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46346.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46346.json"},{"type":"ADVISORY","url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-gj5g-4rxf-8rmq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46346"},{"type":"FIX","url":"https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/intranda/goobi-viewer-core","events":[{"introduced":"0"},{"fixed":"7e5e9de18c572c7b96f80efe01254bf08dc4cdb4"},{"fixed":"9c2c83f00f497c11ab6aaa0bd5a68173cd446eef"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"26.05"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"9c2c83f00f497c11ab6aaa0bd5a68173cd446eef"}]},{"range":[{"fixed":"7e5e9de18c572c7b96f80efe01254bf08dc4cdb4"}],"source":"REFERENCES_TAG","original_tag":"v26.05"}]}}],"versions":["v26.04.1","v26.04","v26.03.8","v26.03.7","v26.03.6","v26.03.5","v26.03.4","v26.03.3","v26.03.2","v26.03.1","v26.03","v26.02.4","v26.02.3","v26.02.2","v26.02.1","v26.02","v26.01.1","v26.01","v25.10.8","v25.10.7","v25.10.6","v25.10.4","v25.10.3","v25.10.2","v25.10.1","v25.10","v25.09.5","v25.09.4","v25.09.3","v25.09.2","v25.09.1","v25.09","v25.08.1","v25.08","v25.06.4","v25.06.3","v25.06.2","v25.06.1","v25.06","v25.05.2","v25.05.1","v25.05","v25.04","v25.02","v25.01","v24.12"],"database_specific":{"vanir_signatures_modified":"2026-10-28T11:01:09Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46346.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java","function":"getAdvancedSearchSelectItems"},"deprecated":false,"digest":{"function_hash":"15972731808254145666261176205669785459","length":2933},"id":"CVE-2026-46346-2ad86a12","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java"},"deprecated":false,"digest":{"line_hashes":["293943419837386175782308880630292377328","170127000326944715759514306120173437552","223072314872435556758862870822129730388","184713866145576581573500654664532882358","237588089203428832734919670992173305409","280990611135733430789396002312530922372","24011410402069477058498461939093920262","243679154761233145932008628234109855606","21245126937807009457669850870559185657","157573805690410280521963065924689943951","49299172231513956195727309028396980246","249794867519244567083176728280977870199","71331133885813258577251813447387200972","231280190624403314206933099108260677099","131064644070503162456003862872168843296","228717970448403275474455688186333628072","147229437546344567055115541779032048353","296771280783092075493187168226162854698","120686590177198208650842153671343843197","185110271319730517681325665849978046676","133072927174758095098837509638475082729","106915568864856288436707486586529388843","160461748305160759432425790653772593920","317668832181560233029467657143735579550","73682667438275365798270958473607512942","249449434883737352069413629640348278192","195647711537184443325539778426838681880","257419450339920369642547725144123517283","112254453685341924447530792146304337784","200506628299564351230936520852436132030","99422724347327295676833174058837105043","141225596712123407189091063186974358645","281192752199487692721550185112564389005","194840973750847596253923718843247966422","336380174445271318603843347024206517237","96952457555478317003593573357220284563","288939005615045911177043736404399404541","328674136467211459900128018005816102742","75851200508167515578606821188405267014","230110937255770512631639417010960709132","243367955632336005134513142238333853843","253728686788632627169401501763323725722","28196279546092511104474535655606889983","240985082911872732109250870253022523110","7405899224190688798808783959628142002","91368197618688457157980371544354479789","158697872569671941832991527465912955348","305106691200856417832257034142201370878","289336218389088023408326258965270312936","32131413311487982245812841291902270705","133528045941229369766499737505022324454","118600259359074066127455075675860467005","277131013592039677111080227322086714878","12132793595964136568255504321677124068","237513637503532782536650314870439478037","203609570456295320982548574336354293445","51906176174227463930981612168786621659","198425266314817376550601752740401743673","239541424654697691920923576302018587810","4477980581229884955895429889103133623","65554406765763519915522339427629544886"],"threshold":0.9},"id":"CVE-2026-46346-46a7ca97","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/UserBean.java"},"deprecated":false,"digest":{"line_hashes":["148290158881224018238036959085333174347","132916980833278222585659789511700743125","39081595628523478911170892959695322332","174004738561766196974963097782734516062","244203758964605445049890537553450586425","6455052961807981930241870601080996339","12522713305268573963244838950780597918","299567008226308523412906777261965860758","38303251870485956995300392521749761620","253576719711034727620542678881631522082","102099897323169189436255478382049411334","248755282447788845428062614811896935669","22824013103778680945337170153593721551","90901951692397126058404997824004916719","897602694625569215338623162217959429","59303525747104975379831032757625057937"],"threshold":0.9},"id":"CVE-2026-46346-66f2dd83","signature_type":"Line"},{"digest":{"length":1437,"function_hash":"132283907619984408157237783707821521826"},"id":"CVE-2026-46346-795cab75","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/UserBean.java","function":"resetPasswordAction"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"104017446139140063737844681867739884294","length":1926},"id":"CVE-2026-46346-bb08964f","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/UserBean.java","function":"sendPasswordResetLinkAction"}}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}]}