Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypass
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 26.05
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Goobi viewer, a web application for displaying digitised material in a browser, is affected. An attacker can send requests with an empty token to protected web API endpoints when the authorization token setting is not configured, bypassing authentication and gaining access to functions that should be restricted.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, Configuration.getWebApiToken returns the empty string when webapi.authorization.token is not configured. AuthorizationFilter compares the supplied token against this default without first checking that the configured token is non-empty. A request to any @AuthorizationBinding-protected endpoint with an empty ?token= value is therefore accepted. This issue has been patched in version 26.05.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- intranda goobi-viewer-core
fixed in 26.05