External risk intelligence

Goobi Viewer Reflected XSS in IIIF Auth Endpoints

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-55486

Goobi viewer is a web application designed to display digitized materials to users in a web browser. As a public-facing web application that handles authentication and content display for digitized collections, it is typically deployed as an internet-accessible service to reach its intended audience.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Goobi viewer, a web application used for displaying digitized materials. This issue could allow for cross-site scripting attacks by manipulating how the application handles authentication requests, potentially impacting user sessions or leading to the execution of malicious scripts. The main concern is to confirm relevance and exposure within our digital asset management infrastructure.

Unvalidated requests enable script injection.
Affects digital asset display and authentication.
Confirm if Goobi viewer is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted link that targets the Goobi viewer's authentication endpoints. The application fails to properly sanitize input in these endpoints, allowing the attacker to inject malicious code that can execute within the user's browser when the user interacts with the Goobi viewer's authentication flow. This can lead to unauthorized actions or data compromise.

Requires unauthenticated network access.
Triggered by user interaction with auth endpoints.
Risk of sensitive data exposure and account takeover.

Live Threat

Current exploitation, exposure, and threat context

The Goobi viewer's authentication endpoints could allow for Cross-Site Scripting (XSS) when a user visits a crafted link. This could occur because the application improperly validates an "origin" parameter, embedding it directly into security headers and JavaScript code, thereby exposing the user's session or any data displayed within the viewer to malicious scripts.

Digitized material and user sessions.
Via specially crafted links.
Unauthorized data access or manipulation.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for the Goobi viewer, likely application or platform owners, must first identify all instances of the affected web application. Subsequently, confirm its reachability and business criticality to prioritize remediation efforts. Finally, engage the appropriate owner for prompt resolution.

Application owners should own the issue.
Verify reachability and business criticality first.
Plan and coordinate remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Goobi viewer software?

Goobi viewer is a specialized web application designed to present digitized cultural and historical materials to the public. It serves as an interface for libraries, archives, and museums, allowing users to browse, search, and view complex digital collections directly within their web browsers.

What kind of vulnerability is CVE-2026-55486?

This vulnerability is classified as Improper Neutralization of Input During Web Page Generation, commonly known as Reflected Cross-Site Scripting (CWE-79). It occurs because the software fails to sanitize user-supplied data in authentication endpoints, allowing attackers to inject and execute unauthorized JavaScript in a victim's browser.

How is this vulnerability triggered?

An attacker triggers the flaw by tricking a user into clicking a specially crafted URL that targets the application's IIIF authentication endpoints. The bug is specifically caused by the mishandling of an 'origin' query parameter. It is not triggered by standard, legitimate navigation that does not involve these specific, malformed authentication requests.

Do I need to worry about this if my Goobi viewer is internal?

Halo Surface Signal indicates that Goobi viewer is typically deployed as an internet-facing service because its primary purpose is sharing digitized collections. While internal instances face lower risk from broad internet-based attacks, any Goobi viewer reachable by users who might be lured into clicking malicious links remains a concern.

When should I update my Goobi viewer?

You should prioritize updating to version 26.05 or later as soon as possible. Your first step is to confirm where Goobi viewer is running in your environment. Once identified, coordinate with the platform owners to schedule the update, as patching is the only way to resolve the underlying input validation failure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.