{"id":"CVE-2026-55463","summary":"Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation","details":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint) accept connections without verifying that the associated HttpSession belongs to a logged-in user, and none validate the Origin header against an allowlist. An unauthenticated attacker can therefore connect to these endpoints; through CampaignEndpoint this allows polluting the in-process crowdsourcing page-lock map and broadcasting forged lock messages, disrupting reviewers' work. This issue has been patched in version 26.05.","aliases":["GHSA-h5m9-fpvw-qr36"],"modified":"2026-10-31T07:03:11.189028546Z","published":"2026-10-23T14:17:06.825Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55463.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-1385","CWE-306","CWE-862"]},"references":[{"type":"WEB","url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55463.json"},{"type":"ADVISORY","url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-h5m9-fpvw-qr36"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55463"},{"type":"FIX","url":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/intranda/goobi-viewer-core","events":[{"introduced":"e1c5fc58feab3d5035140f5743a573d91bd6683f"},{"fixed":"7e5e9de18c572c7b96f80efe01254bf08dc4cdb4"},{"fixed":"8714ca81065d2c2c6e614a1ee6753de65cbe3412"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"4.11.0"},{"fixed":"26.05"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"8714ca81065d2c2c6e614a1ee6753de65cbe3412"}]},{"source":"REFERENCES_TAG","original_tag":"v26.05","range":[{"fixed":"7e5e9de18c572c7b96f80efe01254bf08dc4cdb4"}]}]}}],"database_specific":{"vanir_signatures_modified":"2026-10-31T07:03:11Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55463.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["189669813573452456444402378749265863886","96469561279848577152133005639537992722","130479014063886990389788269767522989415","94139225538776199488222833643833438900","93573582772306912441064968980953276175","278482388510987088742494754009904738827","50863361577017617069895107017726543222","130269544618570183840243249247056085720","19211923499332401416184335792013532537","69295163308904141072758326625336241136","203859751780617765799070683020660972116"],"threshold":0.9},"id":"CVE-2026-55463-01274e64","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/UserEndpoint.java"}},{"id":"CVE-2026-55463-07c81053","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/CampaignEndpoint.java","function":"onError"},"deprecated":false,"digest":{"function_hash":"138782464526486670558280453558778584105","length":155}},{"deprecated":false,"digest":{"line_hashes":["167394688334748627254747826039425229897","91113250503461770287734111721330166262","192889005515769196355724091889749291024","48885706923058075430255196971842501437","124506412653114569616344207894529328156"],"threshold":0.9},"id":"CVE-2026-55463-1e97a032","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/test/java/io/goobi/viewer/websockets/DownloadTaskEndpointTest.java"}},{"signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/GetHttpSessionConfigurator.java","function":"modifyHandshake"},"deprecated":false,"digest":{"function_hash":"218343067194433447228720390772099522514","length":250},"id":"CVE-2026-55463-20adbe15","signature_type":"Function"},{"id":"CVE-2026-55463-21922b04","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"function":"onOpen","file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/UserEndpoint.java"},"deprecated":false,"digest":{"function_hash":"43350417793947173165547334875970620546","length":219}},{"target":{"function":"onOpen","file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/AutocompleteEndpoint.java"},"deprecated":false,"digest":{"function_hash":"187927923050240471897462225526665234311","length":287},"id":"CVE-2026-55463-27aa2758","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412"},{"source":"https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java","function":"getAdvancedSearchSelectItems"},"deprecated":false,"digest":{"function_hash":"15972731808254145666261176205669785459","length":2933},"id":"CVE-2026-55463-2ad86a12","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"function":"onOpen","file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/CampaignEndpoint.java"},"deprecated":false,"digest":{"function_hash":"317383694876553427425481501677094544078","length":285},"id":"CVE-2026-55463-39682a13"},{"source":"https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["293943419837386175782308880630292377328","170127000326944715759514306120173437552","223072314872435556758862870822129730388","184713866145576581573500654664532882358","237588089203428832734919670992173305409","280990611135733430789396002312530922372","24011410402069477058498461939093920262","243679154761233145932008628234109855606","21245126937807009457669850870559185657","157573805690410280521963065924689943951","49299172231513956195727309028396980246","249794867519244567083176728280977870199","71331133885813258577251813447387200972","231280190624403314206933099108260677099","131064644070503162456003862872168843296","228717970448403275474455688186333628072","147229437546344567055115541779032048353","296771280783092075493187168226162854698","120686590177198208650842153671343843197","185110271319730517681325665849978046676","133072927174758095098837509638475082729","106915568864856288436707486586529388843","160461748305160759432425790653772593920","317668832181560233029467657143735579550","73682667438275365798270958473607512942","249449434883737352069413629640348278192","195647711537184443325539778426838681880","257419450339920369642547725144123517283","112254453685341924447530792146304337784","200506628299564351230936520852436132030","99422724347327295676833174058837105043","141225596712123407189091063186974358645","281192752199487692721550185112564389005","194840973750847596253923718843247966422","336380174445271318603843347024206517237","96952457555478317003593573357220284563","288939005615045911177043736404399404541","328674136467211459900128018005816102742","75851200508167515578606821188405267014","230110937255770512631639417010960709132","243367955632336005134513142238333853843","253728686788632627169401501763323725722","28196279546092511104474535655606889983","240985082911872732109250870253022523110","7405899224190688798808783959628142002","91368197618688457157980371544354479789","158697872569671941832991527465912955348","305106691200856417832257034142201370878","289336218389088023408326258965270312936","32131413311487982245812841291902270705","133528045941229369766499737505022324454","118600259359074066127455075675860467005","277131013592039677111080227322086714878","12132793595964136568255504321677124068","237513637503532782536650314870439478037","203609570456295320982548574336354293445","51906176174227463930981612168786621659","198425266314817376550601752740401743673","239541424654697691920923576302018587810","4477980581229884955895429889103133623","65554406765763519915522339427629544886"]},"id":"CVE-2026-55463-46a7ca97","signature_type":"Line","signature_version":"v1"},{"target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/DownloadTaskEndpoint.java"},"deprecated":false,"digest":{"line_hashes":["212724524529307037330830316033647618000","328391213367262815950685883982789969580","59402355423299906525944868265147336262","22303182926158190101553411926118659842","138216078896844418255898032608233903217","297413584697619051948628962295336833437","176908227494880128665329177559840609716","153675016924976758166007005213202671482","288690527470119013389424754516090411753"],"threshold":0.9},"id":"CVE-2026-55463-52379d70","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412"},{"target":{"function":"setUp","file":"goobi-viewer-core/src/test/java/io/goobi/viewer/websockets/CampaignEndpointTest.java"},"deprecated":false,"digest":{"function_hash":"245484018445154754926082606771929957652","length":1046},"id":"CVE-2026-55463-6a3d1b53","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/controller/Configuration.java"},"deprecated":false,"digest":{"line_hashes":["20828603898007908494117051062417382782","86656915863266030649259343751197216715","173444401774872092221789333771785812524"],"threshold":0.9},"id":"CVE-2026-55463-87cd166f"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["51812960223199776848683275929827197648","18160531736411674315499549948324003684","132060226440554826868222820054370357879","96916398206440173707895806901647358547","209376167411306502757569782354538852018","104555700186682893718892747541717502221","53791900818636487653306346252804783586","331702067870617004537778470344059501246","39166694764370414926304902580127277314","13920573432335361844847316637752813271","279807395425984716975706820673995749492","218028417639995920996532851704796348612","212327422733038012306987721012320736247","169577777919979641007741296629247738228","16898885532106034485560386629793953199","270178872457818182267786481521695507028","6936777129715788675344764243270074375","210587971100600811612045113052354943905","68240021322428294024419042819685285730","102398811905487963471404177784783038361"]},"id":"CVE-2026-55463-89a85e61","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/test/java/io/goobi/viewer/websockets/CampaignEndpointTest.java"}},{"deprecated":false,"digest":{"function_hash":"311035141633473691895566133501129668208","length":803},"id":"CVE-2026-55463-8dcf1a36","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"function":"onOpen","file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/LogViewerEndpoint.java"}},{"target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/GetHttpSessionConfigurator.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["311647966031993027637447119760612333523","45042756095273116786299914397343082225","55148530043918451698533139725747167595","26586317873572193688067497051045011749","5656476598684706266163066236901487646","127937796835434512533485053205960440391","84340077183270547102229744575874257649","125813406002925888868846534389187885039","289286987488326553419926957369145967256","37264982382782170011929743832701837687"]},"id":"CVE-2026-55463-bd7e880d","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412"},{"id":"CVE-2026-55463-bfc5115f","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/CampaignEndpoint.java","function":"setPageLock"},"deprecated":false,"digest":{"function_hash":"93920389245523661630890965551004131242","length":480}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/AutocompleteEndpoint.java"},"deprecated":false,"digest":{"line_hashes":["88739587052296063926771489913657831000","272066656297377490341855294121500070498","67766915715831451237984867615896987700","139354470250700600932655400051018183732"],"threshold":0.9},"id":"CVE-2026-55463-dd5cabec"},{"id":"CVE-2026-55463-ddc84397","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/DownloadTaskEndpoint.java","function":"onOpen"},"deprecated":false,"digest":{"function_hash":"312663887759026190073350179365692286750","length":275}},{"digest":{"line_hashes":["178219165928834562851632370663247184040","87528328446094009976179740096906465588","290776235703126892371081843189878183891","56042785608781407400730111090794540445","312534274087111648700825956025332055858","15036206703488978222600028494733688268","59317414568934603025984257520357412565","35617330616381940676441145907024947257"],"threshold":0.9},"id":"CVE-2026-55463-e97ba799","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/filters/CSRFRequestFilter.java"},"deprecated":false},{"digest":{"line_hashes":["316369886973749787499641279678921733890","18395550459813733075661076927438043560","120550050803117529695309759665936926372","953496333816956825164376764335899582","280174422146835840350053232002540539256","88049337364874866960705211952887205730","112004011108022369375145309798208151749","282193752519845716317617727424151013177","65606710339648487349488061845373055594","312310252617611333265322937826434077675","230083546187009633457967132806209509841","116489553235202911881655894707902807872","12506761801128411842899008205876015791","145305119038375373834730527306434793172","275048037615705867960190446418889639798","340157025563382728042217196093950441865","278556798338719161112441328867586407588","106439665546975824025887564228554235006","308433242577278083608252190257265099174","306671991698021845697658477370226115289","175424046984854754087801945659354273506","183963823386245079632170431446494552635","174070636628366604213944620845712191102","5661485299215328874840212923645136156","33586761704943486927880412901464342269","185134059404577516800356788343112606501","142590076345077810909708713669994661739"],"threshold":0.9},"id":"CVE-2026-55463-eb455810","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/CampaignEndpoint.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["237587860927492776512298495746418240248","333795448187885448591911525274832272252","158821531610500021766738320608900962147","66714893350697800833748391709705644500","262727779001649856060439731926061674503","226414360389554439928876932173523889076","43796508425396045094570053396539917696","134129018908304002028290434109590213080","287622085804374567790582712676813472035","326513629301010892461228005928993617904","177781176826994352119443252537138572226","138657732211632054568308308218630221949","300417146355252895149732419093656458140","132366097516602047414918204296977447575","125070284954377712757168075457268404211","205062727442510109970151465324980184722","118340621631835168216964744028950479925","252211063434731285724572426105698937086","235796216591841054091879903286222797324","97319617538237924816749796758187156480","334328141257312619580481029152682459337","98442634754925803808473826296095041918","36134729236468339048902370129342688276","32192757833741075589880275845586924065","89502768318206525562064961487810443392","192676590734310766045166016054898583997","220959680356930796315976143711536408660"],"threshold":0.9},"id":"CVE-2026-55463-f14af923","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/websockets/LogViewerEndpoint.java"}},{"digest":{"threshold":0.9,"line_hashes":["155893635994879177448900446549887256678","141173767962340893048862408021132947399","167276745848169275783907429468889603309"]},"id":"CVE-2026-55463-f2d47ad6","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/8714ca81065d2c2c6e614a1ee6753de65cbe3412","target":{"file":"goobi-viewer-core/src/test/java/io/goobi/viewer/controller/ConfigurationTest.java"},"deprecated":false}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}