# CVE-2026-46346: Goobi viewer predictable password reset token

Source: https://junglewise.ai/threats/cve-2026-46346-the-goobi-viewer-is-a-web-application-that-allows-digitised  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-46346 · Severity: medium · CVSS 6.5 · Published 2026-10-23

Goobi viewer is a web application for displaying digitized content in browsers. An attacker who knows a user's email address can request a password reset and brute-force the reset token, since it is generated from predictable time-based values, allowing unauthorized account takeover.

Technologies: [Intranda Goobi viewer](https://junglewise.ai/threats/technologies/goobi-viewer). Vendors: [Intranda](https://junglewise.ai/threats/vendors/intranda).

## Quick answers

**Is CVE-2026-46346 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46346 being exploited in the wild.

**How severe is CVE-2026-46346?** Medium severity, with a CVSS score of 6.5, published 23 October 2026.

**Which products and versions are affected?** Intranda Goobi viewer prior to 26.05.

**Is there a fix for CVE-2026-46346?** Yes: fixed in 26.05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46346 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-46346?** Check whether you run Intranda Goobi viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.05

## Technical details

The password reset token is generated using SHA-256(currentTimeMillis), making it enumerable within a narrow time window. An attacker can request a password reset for a known email, then brute-force the token by trying all possible millisecond values around the request time. The generated password itself was also weak (SHA-256(currentTimeMillis).substring(0,8)), providing only ~10 bits of entropy. The fix replaces time-based generation with cryptographically secure random values via SecureRandom.

## Affected products

- intranda Goobi viewer prior to 26.05

## Timeline

- 2026-10-23: disclosed
- 2026-06-11: patched: Version 26.05 released

## References

- [https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef](https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef)
- [https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05](https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05)

## Related threats

- [Goobi viewer reflected XSS in IIIF Auth endpoints](https://junglewise.ai/threats/cve-2026-55486-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr injection in spatial search endpoint](https://junglewise.ai/threats/cve-2026-55465-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass in OpenID token validation](https://junglewise.ai/threats/cve-2026-55459-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass via empty API token](https://junglewise.ai/threats/cve-2026-55457-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr injection in RSS servlet](https://junglewise.ai/threats/cve-2026-55444-the-goobi-viewer-is-a-web-application-that-allows-digitised)