{"id":"CVE-2026-55459","summary":"Goobi viewer: OpenID JWT audience not enforced by the verifier","details":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.","aliases":["GHSA-7vrv-qh6g-gfx7"],"modified":"2026-10-28T11:09:58.957878147Z","published":"2026-10-23T14:16:44.995Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-287","CWE-345"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55459.json"},"references":[{"type":"WEB","url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55459.json"},{"type":"ADVISORY","url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-7vrv-qh6g-gfx7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55459"},{"type":"FIX","url":"https://github.com/intranda/goobi-viewer-core/commit/73e2ccb63c36392d46f8d21644592efd6cf87933"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/intranda/goobi-viewer-core","events":[{"introduced":"250e14fcc23a74e620fa2fbeb7abc0c4e2c9ab0c"},{"fixed":"7e5e9de18c572c7b96f80efe01254bf08dc4cdb4"},{"fixed":"73e2ccb63c36392d46f8d21644592efd6cf87933"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"25.01"},{"fixed":"26.05"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"73e2ccb63c36392d46f8d21644592efd6cf87933"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v26.05","range":[{"fixed":"7e5e9de18c572c7b96f80efe01254bf08dc4cdb4"}],"source":"REFERENCES_TAG"}]}}],"versions":["v26.04.1","v26.04","v26.03.8","v26.03.7","v26.03.6","v26.03.5","v26.03.4","v26.03.3","v26.03.2","v26.03.1","v26.03","v26.02.4","v26.02.3","v26.02.2","v26.02.1","v26.02","v26.01.1","v26.01","v25.10.8","v25.10.7","v25.10.6","v25.10.4","v25.10.3","v25.10.2","v25.10.1","v25.10","v25.09.5","v25.09.4","v25.09.3","v25.09.2","v25.09.1","v25.09","v25.08.1","v25.08","v25.06.4","v25.06.3","v25.06.2","v25.06.1","v25.06","v25.05.2","v25.05.1","v25.05","v25.04","v25.02","v25.01"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55459.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4","target":{"function":"getAdvancedSearchSelectItems","file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java"},"deprecated":false,"digest":{"function_hash":"15972731808254145666261176205669785459","length":2933},"id":"CVE-2026-55459-2ad86a12","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"174267371944867381665755458705341736050","length":3654},"id":"CVE-2026-55459-3615f190","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/73e2ccb63c36392d46f8d21644592efd6cf87933","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/authentication/AuthenticationEndpoint.java","function":"openIdLogin"}},{"target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java"},"deprecated":false,"digest":{"line_hashes":["293943419837386175782308880630292377328","170127000326944715759514306120173437552","223072314872435556758862870822129730388","184713866145576581573500654664532882358","237588089203428832734919670992173305409","280990611135733430789396002312530922372","24011410402069477058498461939093920262","243679154761233145932008628234109855606","21245126937807009457669850870559185657","157573805690410280521963065924689943951","49299172231513956195727309028396980246","249794867519244567083176728280977870199","71331133885813258577251813447387200972","231280190624403314206933099108260677099","131064644070503162456003862872168843296","228717970448403275474455688186333628072","147229437546344567055115541779032048353","296771280783092075493187168226162854698","120686590177198208650842153671343843197","185110271319730517681325665849978046676","133072927174758095098837509638475082729","106915568864856288436707486586529388843","160461748305160759432425790653772593920","317668832181560233029467657143735579550","73682667438275365798270958473607512942","249449434883737352069413629640348278192","195647711537184443325539778426838681880","257419450339920369642547725144123517283","112254453685341924447530792146304337784","200506628299564351230936520852436132030","99422724347327295676833174058837105043","141225596712123407189091063186974358645","281192752199487692721550185112564389005","194840973750847596253923718843247966422","336380174445271318603843347024206517237","96952457555478317003593573357220284563","288939005615045911177043736404399404541","328674136467211459900128018005816102742","75851200508167515578606821188405267014","230110937255770512631639417010960709132","243367955632336005134513142238333853843","253728686788632627169401501763323725722","28196279546092511104474535655606889983","240985082911872732109250870253022523110","7405899224190688798808783959628142002","91368197618688457157980371544354479789","158697872569671941832991527465912955348","305106691200856417832257034142201370878","289336218389088023408326258965270312936","32131413311487982245812841291902270705","133528045941229369766499737505022324454","118600259359074066127455075675860467005","277131013592039677111080227322086714878","12132793595964136568255504321677124068","237513637503532782536650314870439478037","203609570456295320982548574336354293445","51906176174227463930981612168786621659","198425266314817376550601752740401743673","239541424654697691920923576302018587810","4477980581229884955895429889103133623","65554406765763519915522339427629544886"],"threshold":0.9},"id":"CVE-2026-55459-46a7ca97","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4"},{"source":"https://github.com/intranda/goobi-viewer-core/commit/73e2ccb63c36392d46f8d21644592efd6cf87933","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/authentication/AuthenticationEndpoint.java","function":"verifyOpenIdToken"},"deprecated":false,"digest":{"length":1395,"function_hash":"331472976193676884271031083534092887817"},"id":"CVE-2026-55459-99b4e32d","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/73e2ccb63c36392d46f8d21644592efd6cf87933","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v1/authentication/AuthenticationEndpoint.java"},"deprecated":false,"digest":{"line_hashes":["91813567716036644348895317352949482101","272896740542039399162925377346020792662","151424985423629999669121422619484555539","144672725207034755094904769990589835406","3919271050813400565037797741735980264","246665324604199014260694027558739624525","258050995315643680663866677357933919984","173426883874127942432159167880712242132","291867922490064271066914474377647845038","324355614189568963665857409788488628450","52645000605412873616549127197365255903","88216370832688447333367739615973673064","175885193764719355798601178218758717810","115619167613621928809709791014674636759","248655863502398696974679376033694392010","107168966320856687901367257987353551556","335279283339977014158799057913583267070","251184272396245795368212137377380535025","36196617272468427401267980862604204865","11914914427385090128843047277366307272","276523523146949246515038085787282540258","227114463227043225872492350578974844775","179542988368186478354873740208801285077","135175168790139113981115633784116990557"],"threshold":0.9},"id":"CVE-2026-55459-d808ec71","signature_type":"Line"}],"vanir_signatures_modified":"2026-10-28T11:09:58Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}