Is CVE-2026-55486 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55486 being exploited in the wild.

How severe is CVE-2026-55486?

Critical severity, with a CVSS score of 9.3, published 23 October 2026.

Which products and versions are affected?

Intranda Goobi viewer 25.08 to 26.04.

Is there a fix for CVE-2026-55486?

Yes: fixed in 26.05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55486 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55486?

Check whether you run Intranda Goobi viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55486: Goobi viewer reflected XSS in IIIF Auth endpoints

CVE-2026-55486 · Severity: critical · CVSS 9.3 · Published 2026-10-23

Goobi viewer is a web application that displays digitized library materials in web browsers. Versions 25.08 through 26.04 contain a reflected cross-site scripting vulnerability in the authentication flow endpoints that allows attackers to inject malicious scripts by manipulating the origin parameter. An attacker can craft a malicious link to steal session tokens, hijack user accounts, or perform unauthorized actions on behalf of authenticated users.

Technologies: Intranda Goobi viewer. Vendors: Intranda.

Quick answers

Is CVE-2026-55486 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55486 being exploited in the wild.
How severe is CVE-2026-55486?: Critical severity, with a CVSS score of 9.3, published 23 October 2026.
Which products and versions are affected?: Intranda Goobi viewer 25.08 to 26.04.
Is there a fix for CVE-2026-55486?: Yes: fixed in 26.05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55486 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55486?: Check whether you run Intranda Goobi viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.05

Technical details

The vulnerability exists in the IIIF Auth 2.0 endpoints (auth/login and auth/token) within AuthorizationFlowResource, which accept an unsanitized origin query parameter. This parameter is embedded directly into both the Content-Security-Policy frame-ancestors response header and HTML response body as a JavaScript single-quoted argument without escaping, enabling reflected XSS. An attacker controlling the login and token call initiators can exploit this to execute arbitrary JavaScript in users' browsers.

Affected products

intranda Goobi viewer 25.08 to 26.04

Timeline

2026-10-23: disclosed
2026-05-27: patched: Fix committed; version 26.05 released 2026-06-11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.