Goobi Viewer Core EUVD-2026-109067

Exploitation requires an attacker-crafted request to the AuthorizationFlowResource IIIF Auth 2.0 endpoints auth/login or auth/token with a malicious origin query parameter, and a victim who is induced to open it (UI:R). Per the vendor advisory, a DEFAULT install is exploitable via top-level navigation to the vulnerable endpoint because the shipped reverse-proxy configuration sets no script-src Content-Security-Policy; the shipped X-Frame-Options: DENY and frame-ancestors 'self' only block the cross-origin iframe-delivery variant and the CSP-header malformation, not the top-level-navigation path. The stealthier embedded-iframe variant additionally requires an install that has dropped those framing headers. For impact on session data and state-changing requests, the victim must hold an authenticated viewer session. Affected versions: >= 25.08 and < 26.05.

Multiple signals align toward genuine priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3) describes a network-reachable, low-complexity, unauthenticated-to-trigger reflected XSS whose only gating factor is victim user interaction and whose scope change plus High confidentiality/integrity reflect script execution in the viewer's authenticated origin. The vuln.today Decision label is act_now, consistent with the vendor's own confirmation that a default install is exploitable via top-level navigation. However, several widely-used signals are ABSENT from the input and should not be fabricated: no EPSS exploitation-probability score is provided, the CVE is not listed as being in CISA KEV in the input, and no proof-of-concept or working-exploit reference is supplied (only the GHSA advisory, the fix commit, and the release tag). There is therefore no evidence of active exploitation or public exploit code - the urgency rests on the act_now decision label, the 9.3 severity, and the vendor-confirmed default-install exploitability, not on observed in-the-wild activity. The main thing that tempers raw severity is the UI:R requirement: exploitation needs a victim to be socially engineered into opening a crafted request, and meaningful impact additionally needs that victim to hold an authenticated viewer session. Net assessment: a real, high-priority patch item for Goobi viewer operators, but its real-world blast radius is bounded by the product's niche deployment footprint and by the social-engineering/session prerequisites rather than being a mass-exploitable internet-wide issue.

An attacker crafts a link to the viewer's auth/token (or auth/login) endpoint with a malicious origin query parameter containing JavaScript, then lures a user who is logged into the Goobi viewer to open it via a top-level navigation. Because the origin value is reflected unescaped into a single-quoted postMessage argument in the HTML body, the attacker's script executes in the viewer's origin, granting access to the victim's authenticated session and the ability to issue state-changing requests in the victim's name. No public exploit code is referenced in the available data; exploitation is low-complexity (AC:L) and network-delivered but requires the victim's interaction (UI:R).