CVE-2026-55486

Summary

The Goobi viewer's IIIF Auth 2.0 endpoints accept an unvalidated 'origin' query parameter and embed it into both a Content-Security-Policy header and an HTML response body as an unescaped JavaScript string, leading to reflected XSS when an attacker tricks a user into visiting a crafted URL.

Exploitability

Exploitation requires social engineering (e.g., phishing) to诱导 the victim to click a malicious link, as user interaction is needed to trigger the reflected XSS.

Blast radius

Successful exploitation could allow attackers to steal session tokens, perform actions on behalf of the user, or exfiltrate sensitive digitized content displayed in the viewer.

Detection

Look for HTTP responses containing a Content-Security-Policy header with a frame-ancestors directive derived from an unexpected or attacker-controlled origin value, and/or HTML responses embedding unescaped origin values in JavaScript string literals.

Prioritized remediation

Upgrade to Goobi viewer version 26.05 or later, which patches the unvalidated origin parameter handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.