CVE-2026-55459

The record

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.require(algorithm).withIssuer(issuer).build() and does not enforce the aud claim during cryptographic validation. The aud check is performed manually afterwards via a single string-equality call, which only handles single-string aud values. In a multi-RP IdP setup, a token whose single-string aud matches the viewer's client ID but was issued for a different relying party passes the check and authenticates the attacker as the token's sub. This issue has been patched in version 26.05.

Affected packages

Related vulnerabilities

• CVE-2026-63398 Coop is an open source review and moderation tool from ROOST. CWE-287
• CVE-2026-116239 In server mode pgAdmin 4 keeps an account per authentication source, so the same username… CWE-287
• CVE-2026-62264 PDF Reader MCP is a Model Context Protocol server for reading PDF documents. CWE-287
• CVE-2026-61739 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-287
• CVE-2026-110799 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or… CWE-287
• CVE-2026-119572 Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in… CWE-287
• CVE-2026-118194 The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass… CWE-287
• CVE-2026-114443 The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before… CWE-287