CVE-2026-46346 intranda CVE debrief

Who should care

Defenders responsible for Goobi viewer deployments should assess exposure and prioritize patching to version 26.05 or later. They should also verify password reset functionality to prevent unauthorized access. Additionally, defenders should review compensating controls for exposed systems and monitor for suspicious password reset attempts.

Why it matters

Defenders should prioritize patching Goobi viewer to version 26.05 or later due to a predictable password reset token vulnerability, and verify password reset functionality to prevent unauthorized access.

• Potential unauthorized password reset
• Brute-force vulnerability in password reset token
• Need for patching to version 26.05 or later

Technical summary

The Goobi viewer, a web application for displaying digitized material, had a predictable password reset token vulnerability prior to version 26.05. An attacker who knows a target's email address can request a password reset and brute-force the token, allowing unauthorized password reset. The vulnerability was caused by the predictable nature of the password reset token, which was based on the time of the reset request. This issue has been patched in version 26.05, and defenders should prioritize patching to prevent unauthorized access.

Defensive priority

Defenders should prioritize patching to version 26.05 or later, and verify password reset functionality.

Recommended defensive actions

• Patch to version 26.05 or later
• Verify password reset functionality
• Monitor for suspicious password reset attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and patched version. The Goobi viewer web application, prior to version 26.05, had a predictable password reset token vulnerability. The CVE Program record and NIST NVD detail page offer additional information on the vulnerability and its impact. Defenders should verify password reset functionality to prevent unauthorized access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.