CVE-2026-46347 intranda CVE debrief

Who should care

Goobi viewer administrators and users with exposure to vulnerable versions should assess their exposure and prioritize upgrading to version 26.05 or later. They should review password reset procedures and ensure secure password generation. They should also monitor for potential account takeover attempts. The affected operator, platform, vulnerability-management, and security-team impact should be reviewed to ensure a comprehensive understanding of the

Why it matters

The predictable replacement password generation issue in Goobi viewer versions prior to 26.05 requires attention from administrators and users to prevent potential account takeovers and ensure secure password generation.

• Potential account takeover after password reset
• Brute-force attacks possible due to predictable password generation
• Need for secure password generation and reset procedures

Technical summary

The Goobi viewer application generated replacement passwords in a predictable way, allowing for potential brute-force attacks. This issue was patched in version 26.05. The predictable replacement password generation issue in Goobi viewer versions prior to 26.05 requires attention from administrators and users to prevent potential account takeovers and ensure secure password generation. The insufficient entropy allowed the password to be brute-forced by an attacker who can approximate the server-side generation time. Exploiting this finding in isolation requires the victim to have triggered the reset themselves and the attacker to infer the server time from network or email metadata.

Defensive priority

Medium priority for Goobi viewer administrators and users with exposure to the vulnerable versions.

Recommended defensive actions

• Upgrade to Goobi viewer version 26.05 or later
• Review password reset procedures and ensure secure password generation
• Monitor for potential account takeover attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the predictable replacement password generation issue in Goobi viewer versions prior to 26.05. The issue has been patched in version 26.05. The CVE record was published on 2026-10-23T14:14:51.802Z and has not been modified since then. The source item providing details on the predictable replacement password generation issue. The official CVE Program record with source-provided CVE metadata and the official NIST NVD detail page and source-specific vulnerability assessment provide

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.