Goobi Viewer Core CVE-2026-46346

The attacker must know the target account's registered email address and must be able to reach the /user/resetpw/ reset endpoint, which is exposed by default. No authentication, privileges, or user interaction are required, and no non-default configuration is needed - the token for any version prior to 26.05 is predictably derived from the request time (System.currentTimeMillis()). What LIMITS exploitation: the impact of this flaw in isolation is confined to forcing a password reset and locking the victim out of their account - it does not by itself reveal the new password or grant access. Full account takeover requires chaining with CVE-2026-46347. The vendor's only complete fix is updating to 26.05; as a temporary workaround the advisory states the /user/resetpw/ endpoint can be blocked via a reverse proxy, Apache httpd LocationMatch, or a Tomcat web.xml security-constraint, which disables password reset for all users.

The CVSS base score is 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - network-reachable, low complexity, no privileges and no user interaction, so unauthenticated remote attackers can trigger it. However, the impact is deliberately scoped as C:N/I:L/A:L: exploiting this flaw alone only forces an unauthorized password reset, which changes the victim's password and locks them out (integrity/availability) but does not grant the attacker access. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit reference is present, so there is no signal of active or widespread exploitation. The vuln.today Decision label is this_month (not act_now or emergency), which is consistent with the medium severity and absent exploitation signals. The most important risk amplifier is explicitly stated in the vendor advisory: chained with GHSA-hw9w-7r6g-2fjc (CVE-2026-46347) this becomes full unauthenticated account takeover at a combined CVSS of 9.1 (Critical). Treat it as a real but non-emergency priority on its own, with elevated urgency wherever CVE-2026-46347 is also unpatched.

An attacker who knows a victim's registered email address submits a password-reset request to the Goobi viewer, then brute-forces the activation token because it is derived from System.currentTimeMillis() at the moment of the request (a value the attacker effectively controls by timing their own request). Succeeding forces a password reset on the victim's account, locking them out; no public exploit code was identified at time of analysis. If the companion vulnerability CVE-2026-46347 is also present, the same flow escalates to full account takeover.