A predictable algorithm generates a replacement password when a user requests a password reset in Goobi viewer before version 26.05. The substitution password is constructed with insufficient entropy, allowing an attacker to brute‑force the password if they can estimate the server’s time of generation. The flaw is related to CWE‑330, CWE‑340, and CWE‑640. The impact is that an attacker who can observe a reset email can gain unauthorized access to the affected account, leading to confidentiality and integrity violations of that user’s data using the compromised credential.

The vulnerability affects the Goobi viewer web application for intranda, specifically the goobi‑viewer‑core component. All instances running versions earlier than 26.05 are susceptible. Versions 26.05 and later contain the fix that replaces the deterministic password generation with a random, high‑entropy value.

The CVSS score of 6.8 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the victim to initiate a reset and the attacker to approximate the server time from email or network metadata, which limits widespread practical exploitation. However, when these conditions are met the attacker can recover the reset password and take over the account.