A predictable password reset token allows an attacker who knows a target’s email address to request a password reset and then brute‑force the token, enabling an unauthorized password reset on any account. The weakness stems from using the time of request to derive the token, making it susceptible to enumeration (CWE-330, CWE-340, CWE-640). This flaw has a medium severity CVSS score of 6.5 and could be used to compromise any user account whose email is known.

The vulnerability affects the Goobi viewer web application, specifically the intranda:goobi-viewer-core component. All installations of Goobi viewer preceding version 26.05 are susceptible, while version 26.05 and later include the patch.

The problem is listed with a CVSS of 6.5 and lacks an EPSS score, indicating no available data on current exploitation probability. The Issue is not in the CISA KEV catalog. An attacker can trigger the reset via the public password‑reset interface, then brute‑force the predictable token until it matches the one generated by the server. This straightforward attack path presents a realistic threat to any user whose email is discoverable.