Goobi Viewer Core EUVD-2026-109086

Standalone exploitation requires that the victim has already triggered a password reset themselves, and that the attacker can approximate the server-side time at which the replacement password was generated from network or email metadata - only then can the low-entropy password (originally 4 bytes) be brute-forced to log in as the victim. Limiting factors: dependency on victim-initiated reset (UI:R) and on timing inference (AC:H), which prevent trivial mass exploitation. These limits are removed when chained with CVE-2026-46346, which disables the victim-initiation requirement for full unauthenticated takeover. Affected: goobi-viewer-core < 26.05; fixed in 26.05 (commits 9c2c83f and 1fa7a30a). The vendor states a reverse-proxy/Tomcat block disabling the /user/resetpw/ endpoint entirely is the only workaround (it disables password reset for all users); updating to 26.05 is the complete fix.

This is a medium-severity issue (CVSS 6.8) whose real-world standalone risk is constrained by two factors in the vector: AC:H, because the attacker must approximate the server-side password-generation time from network or email metadata, and UI:R, because the victim must have initiated the password reset themselves. PR:N confirms no authentication is needed. No EPSS score, KEV listing, or public exploit is present in the input, and the vuln.today Decision label is 'this_month' - not act_now or emergency - so this is a prioritize-and-patch item rather than a drop-everything emergency. The critical escalation signal comes from the vendor advisory: chained with CVE-2026-46346 (GHSA-gj5g-4rxf-8rmq), the victim-interaction requirement disappears and an attacker with only the victim's email achieves full unauthenticated account takeover at a combined CVSS of 9.1. Treat the realistic priority as driven by that chain: if CVE-2026-46346 is also present/unpatched, effective risk is far higher than this CVE's 6.8 implies.

A victim initiates a password reset on a Goobi viewer instance (< 26.05). An attacker who can observe network or email metadata approximates the server-side timestamp at which the replacement password was generated and brute-forces the low-entropy value (originally only 4 bytes, per commit 9c2c83f), then logs in as the victim. No public exploit is identified in the input; AC:H reflects the timing-inference requirement and UI:R reflects the need for victim-initiated reset.