CVE-2026-46347

The record

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a password reset link is visited, the application generates a replacement password in a predictable way and emails it to the account holder. The insufficient entropy allows the password to be brute-forced by an attacker who can approximate the server-side generation time. Exploiting this finding in isolation requires the victim to have triggered the reset themselves and the attacker to infer the server time from network or email metadata. This issue has been patched in version 26.05.

Affected packages

Related vulnerabilities

• CVE-2026-79981 The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured… CWE-330
• CVE-2026-106074 A flaw in Node.js `crypto` causes the internal entropy caches used by… CWE-330
• CVE-2026-46346 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-330
• CVE-2026-55889 XDG Desktop Portal is a desktop integration portal. CWE-330
• CVE-2026-114576 A vulnerability has been found in Linksys RE6250 1.0.04.001. CWE-330
• CVE-2026-53939 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption… CWE-330
• CVE-2026-79575 The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current… CWE-330
• CVE-2026-86187 WWBN AVideo generates passwords for external-login accounts using rand() instead of a… CWE-330