# CVE-2026-55486: Goobi viewer reflected XSS in IIIF Auth endpoints

Source: https://junglewise.ai/threats/cve-2026-55486-the-goobi-viewer-is-a-web-application-that-allows-digitised  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-55486 · Severity: critical · CVSS 9.3 · Published 2026-10-23

Goobi viewer is a web application that displays digitized library materials in web browsers. Versions 25.08 through 26.04 contain a reflected cross-site scripting vulnerability in the authentication flow endpoints that allows attackers to inject malicious scripts by manipulating the origin parameter. An attacker can craft a malicious link to steal session tokens, hijack user accounts, or perform unauthorized actions on behalf of authenticated users.

Technologies: [Intranda Goobi viewer](https://junglewise.ai/threats/technologies/goobi-viewer). Vendors: [Intranda](https://junglewise.ai/threats/vendors/intranda).

## Quick answers

**Is CVE-2026-55486 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55486 being exploited in the wild.

**How severe is CVE-2026-55486?** Critical severity, with a CVSS score of 9.3, published 23 October 2026.

**Which products and versions are affected?** Intranda Goobi viewer 25.08 to 26.04.

**Is there a fix for CVE-2026-55486?** Yes: fixed in 26.05. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55486 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55486?** Check whether you run Intranda Goobi viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.05

## Technical details

The vulnerability exists in the IIIF Auth 2.0 endpoints (auth/login and auth/token) within AuthorizationFlowResource, which accept an unsanitized origin query parameter. This parameter is embedded directly into both the Content-Security-Policy frame-ancestors response header and HTML response body as a JavaScript single-quoted argument without escaping, enabling reflected XSS. An attacker controlling the login and token call initiators can exploit this to execute arbitrary JavaScript in users' browsers.

## Affected products

- intranda Goobi viewer 25.08 to 26.04

## Timeline

- 2026-10-23: disclosed
- 2026-05-27: patched: Fix committed; version 26.05 released 2026-06-11

## References

- [https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b](https://github.com/intranda/goobi-viewer-core/commit/0e488c6b02a28c1d1a747dfe3958ad2bbcff2d0b)
- [https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05](https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05)

## Related threats

- [Goobi viewer Solr injection in spatial search endpoint](https://junglewise.ai/threats/cve-2026-55465-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass in OpenID token validation](https://junglewise.ai/threats/cve-2026-55459-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer authentication bypass via empty API token](https://junglewise.ai/threats/cve-2026-55457-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr injection in RSS servlet](https://junglewise.ai/threats/cve-2026-55444-the-goobi-viewer-is-a-web-application-that-allows-digitised)
- [Goobi viewer Solr query injection via regex bypass](https://junglewise.ai/threats/cve-2026-55442-the-goobi-viewer-is-a-web-application-that-allows-digitised)