CVE-2026-55459 intranda CVE debrief

Who should care

Defenders responsible for Goobi viewer installations, particularly those using multi-RP IdP setups, should assess exposure and apply the patch. They should also prioritize verifying their inventory, assessing exposure, and applying the patch from version 26.05. Additionally, they should monitor for authentication anomalies and review compensating controls for exposed systems.

Why it matters

The Goobi viewer vulnerability allows an attacker to authenticate using a token issued for a different relying party, potentially bypassing authentication in multi-RP IdP setups. Defenders should prioritize verifying their inventory, assessing exposure, and applying the patch.

• Potential authentication bypass in multi-RP IdP setups
• Need to verify inventory and exposure to vulnerable versions
• Priority on applying patch from version 26.05
• Monitoring for authentication anomalies

Technical summary

The Goobi viewer application does not enforce the aud claim during OpenID JWT cryptographic validation, allowing a token issued for a different relying party to authenticate an attacker. This issue exists from version 25.01 to before version 26.05 and has been patched in version 26.05. The vulnerability impacts multi-RP IdP setups, potentially bypassing authentication. Defenders should prioritize verifying their inventory of Goobi viewer installations, assessing exposure, and applying the patch from version 26.05 as soon as possible.

Defensive priority

Defenders should prioritize verifying their inventory of Goobi viewer installations, assessing exposure, and applying the patch from version 26.05 as soon as possible.

Recommended defensive actions

• Verify inventory of Goobi viewer installations
• Assess exposure to vulnerable versions
• Apply patch from version 26.05
• Monitor for potential authentication anomalies
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the patched version. However, there is limited information on potential exploitation or affected deployments. Defenders should verify their inventory, assess exposure, and apply the patch from version 26.05. They should also monitor for authentication anomalies and review compensating controls for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.