{"id":"CVE-2026-55486","summary":"Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS","details":"The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.","aliases":["GHSA-975w-g9gj-xq48"],"modified":"2026-11-01T07:03:42.989889610Z","published":"2026-10-23T14:17:42.732Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-113","CWE-1336","CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55486.json"},"references":[{"type":"WEB","url":"https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55486.json"},{"type":"ADVISORY","url":"https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-975w-g9gj-xq48"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55486"},{"type":"FIX","url":"https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/intranda/goobi-viewer-core","events":[{"introduced":"a78eb259fb9596c73f84f5384a28c7dec01461e4"},{"fixed":"7e5e9de18c572c7b96f80efe01254bf08dc4cdb4"},{"fixed":"0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"25.08"},{"fixed":"26.05"}]},{"range":[{"fixed":"0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"7e5e9de18c572c7b96f80efe01254bf08dc4cdb4"}],"source":"REFERENCES_TAG","original_tag":"v26.05"}]}}],"versions":["v26.04.1","v26.04","v26.03.8","v26.03.7","v26.03.6","v26.03.5","v26.03.4","v26.03.3","v26.03.2","v26.03.1","v26.03","v26.02.4","v26.02.3","v26.02.2","v26.02.1","v26.02","v26.01.1","v26.01","v25.10.8","v25.10.7","v25.10.6","v25.10.4","v25.10.3","v25.10.2","v25.10.1","v25.10","v25.09.5","v25.09.4","v25.09.3","v25.09.2","v25.09.1","v25.09","v25.08.1","v25.08"],"database_specific":{"vanir_signatures_modified":"2026-11-01T07:03:42Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55486.json","vanir_signatures":[{"id":"CVE-2026-55486-2ad86a12","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java","function":"getAdvancedSearchSelectItems"},"deprecated":false,"digest":{"function_hash":"15972731808254145666261176205669785459","length":2933}},{"id":"CVE-2026-55486-46a7ca97","signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/7e5e9de18c572c7b96f80efe01254bf08dc4cdb4","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/SearchBean.java"},"deprecated":false,"digest":{"line_hashes":["293943419837386175782308880630292377328","170127000326944715759514306120173437552","223072314872435556758862870822129730388","184713866145576581573500654664532882358","237588089203428832734919670992173305409","280990611135733430789396002312530922372","24011410402069477058498461939093920262","243679154761233145932008628234109855606","21245126937807009457669850870559185657","157573805690410280521963065924689943951","49299172231513956195727309028396980246","249794867519244567083176728280977870199","71331133885813258577251813447387200972","231280190624403314206933099108260677099","131064644070503162456003862872168843296","228717970448403275474455688186333628072","147229437546344567055115541779032048353","296771280783092075493187168226162854698","120686590177198208650842153671343843197","185110271319730517681325665849978046676","133072927174758095098837509638475082729","106915568864856288436707486586529388843","160461748305160759432425790653772593920","317668832181560233029467657143735579550","73682667438275365798270958473607512942","249449434883737352069413629640348278192","195647711537184443325539778426838681880","257419450339920369642547725144123517283","112254453685341924447530792146304337784","200506628299564351230936520852436132030","99422724347327295676833174058837105043","141225596712123407189091063186974358645","281192752199487692721550185112564389005","194840973750847596253923718843247966422","336380174445271318603843347024206517237","96952457555478317003593573357220284563","288939005615045911177043736404399404541","328674136467211459900128018005816102742","75851200508167515578606821188405267014","230110937255770512631639417010960709132","243367955632336005134513142238333853843","253728686788632627169401501763323725722","28196279546092511104474535655606889983","240985082911872732109250870253022523110","7405899224190688798808783959628142002","91368197618688457157980371544354479789","158697872569671941832991527465912955348","305106691200856417832257034142201370878","289336218389088023408326258965270312936","32131413311487982245812841291902270705","133528045941229369766499737505022324454","118600259359074066127455075675860467005","277131013592039677111080227322086714878","12132793595964136568255504321677124068","237513637503532782536650314870439478037","203609570456295320982548574336354293445","51906176174227463930981612168786621659","198425266314817376550601752740401743673","239541424654697691920923576302018587810","4477980581229884955895429889103133623","65554406765763519915522339427629544886"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v2/auth/AuthorizationFlowResource.java","function":"loginService"},"deprecated":false,"digest":{"function_hash":"217564182671257611328788095084106724081","length":834},"id":"CVE-2026-55486-7e4dda73","signature_type":"Function"},{"source":"https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b","target":{"function":"getTokenServiceResponseBody","file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v2/auth/AuthorizationFlowResource.java"},"deprecated":false,"digest":{"length":363,"function_hash":"224339381220018724517199017011283252632"},"id":"CVE-2026-55486-d4ef7ac1","signature_type":"Function","signature_version":"v1"},{"target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v2/auth/AuthorizationFlowResource.java","function":"accessTokenService"},"deprecated":false,"digest":{"function_hash":"182402293228250217037059672687716565478","length":1494},"id":"CVE-2026-55486-e245c114","signature_type":"Function","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b","target":{"file":"goobi-viewer-core/src/main/java/io/goobi/viewer/api/rest/v2/auth/AuthorizationFlowResource.java"},"deprecated":false,"digest":{"line_hashes":["81083066986560238691008379660189218013","267284321959349482084159495796835272758","16265764325371146789490231099189842025","42496812359593404023306303615841588684","215725964946134855770870371725769379787","293239867460488088726989089446687900882","229575010011859010217060585500110615235","106055999154384710828492079003405144065","162470821046664910243473751704207716579","137135931348350916942325359779543558162","304903526987538409496227142321303327184","161936341964033348672286770833362989218","47845620073602340873466432325502923400","58880347090472746890754974871320102632","295598217488265295302643601340222341146","259925561666455719263329987893343924921","73877677303247437165086307749672891797","1142803456500026777877583701044675989","249954026306405799150696282647674494104","159718661643596565619322772422355462892","182498516234065793114477487713271614849","281513286071723232357616088300215858816","54931801689568200676251500705391485227","27229270251459756043049864785923879684","274312714102680048531793786342442698137","133807095659798922812834514649166381331","178600989480196910965751553877446248434","140168774205994088416535837202370831094","91993370650319353925181766610297613427","54545773689475212334801237811245479488","156122567138616920202758862630969712863","40537156697980705455141864072854190312","292817711966160744296818623514109475594","286971520813027058548463807381344649899","290905718224309850962242703768575117178","182796943300830901894686977003252735874","209979394113446481115362963410886947619","117740843996648444948447569204347908490","252903322302013520781791296179115183324","253460158362983609023549653637837497497","216420792613743914566303535019293413778","167410467791386952728353667894475932811","52368217119520806132598299752014409708","72253753042429298332192483891234314058","259745422557890366620008756452860708340","90401530538944457527372014815395594009","18740449959003676133843487816364843700","288277773206657949367474460220549146553","144082048129026669541898551920937764113","34490189220298921439801534328894577777","291497306396367651302411254816186127823","187610784270789423864865039383465671402","39700972574131112427265714238613167530","2183607547490554861638445710766890044","52613038688732248853296045236245842014","226611411886721185712791166233802335096","298462450054095135317765765665332351832","237417110459845303843258505918549620206","199775475900087735723571435194305648958","240624156986883404081278635869033781825","11611970794144237132074185915853317586","222224555075092866581175230796724356091","232229124209385286855459355961006626795","119872902849994114282709568006188074860","167254424726201729619754415965492405683","151566484692135911986790415118320806394","105876680166622138267942819680036041436","151810807019191775553258894358385391585","160516004798529977938384959685637063838","272736239945361682747151151699886134961","168162948987106352313964947792282822489","235435941663578290828150806977522242871","315357763160317795430524983174533153359","153459171112309766319071844637911848550","45829029471833550118698457012233188770","177918851746991147953043765378848405467","266356282406086200620809027949135540116","286751658172588082338384253139547321565","191926809113802116213795213402804579621","309738650105929614123104067918471776819","252713045120867603397134791278046353730","329146400423205630246567951206446946088","79960783409093227323799811696970298566","272736239945361682747151151699886134961","168162948987106352313964947792282822489"],"threshold":0.9},"id":"CVE-2026-55486-f26cd431"}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"}]}