# CVE-2026-46347: Intranda Goobi viewer weak password generation in reset flow

Source: https://junglewise.ai/threats/cve-2026-46347-the-goobi-viewer-is-a-web-application-that-allows-digitised  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-46347 · Severity: medium · CVSS 6.8 · Published 2026-10-23

Goobi viewer is a web application for displaying digitized library materials. Prior to version 26.05, the application generates password reset tokens with insufficient randomness, allowing an attacker who observes the approximate time of a password reset request to brute-force the new password. An attacker would need the victim to initiate a password reset and would need to infer the server time from network metadata or email timestamps.

Technologies: [Intranda Goobi viewer](https://junglewise.ai/threats/technologies/goobi-viewer). Vendors: [Intranda](https://junglewise.ai/threats/vendors/intranda).

## Quick answers

**Is CVE-2026-46347 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46347 being exploited in the wild.

**How severe is CVE-2026-46347?** Medium severity, with a CVSS score of 6.8, published 23 October 2026.

**Which products and versions are affected?** Intranda Goobi viewer prior to 26.05.

**Is there a fix for CVE-2026-46347?** Yes: fixed in 26.05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46347 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-46347?** Check whether you run Intranda Goobi viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.05

## Technical details

The vulnerability is weak entropy in password generation during the password reset flow. The application generated reset passwords from only 4 bytes of random data encoded as 8 hex characters (~16 bits of entropy), and used predictable time-based seeding. An attacker with knowledge of the approximate reset time can enumerate possible passwords. The fix increases the random data to 7 bytes (56 bits of entropy) and replaces time-based generation with SecureRandom.

## Affected products

- Intranda Goobi viewer prior to 26.05

## Timeline

- 2026-10-23: disclosed
- 2026-10-23: patched: version 26.05

## References

- [https://github.com/intranda/goobi-viewer-core/commit/1fa7a30a3a7699a82ea0df9c1a8997b2894d7841](https://github.com/intranda/goobi-viewer-core/commit/1fa7a30a3a7699a82ea0df9c1a8997b2894d7841)
- [https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef](https://github.com/intranda/goobi-viewer-core/commit/9c2c83f00f497c11ab6aaa0bd5a68173cd446eef)

## Related threats

- [Goobi viewer reflected XSS in IIIF Auth endpoints](https://junglewise.ai/threats/cve-2026-55486-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr injection in spatial search endpoint](https://junglewise.ai/threats/cve-2026-55465-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass in OpenID token validation](https://junglewise.ai/threats/cve-2026-55459-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass via empty API token](https://junglewise.ai/threats/cve-2026-55457-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr injection in RSS servlet](https://junglewise.ai/threats/cve-2026-55444-the-goobi-viewer-is-a-web-application-that-allows-digitised)