The Goobi viewer web application returned an empty string as the default webapi.authorization.token value when no token was specified in the configuration. The AuthorizationFilter compared the supplied token against this default string without first verifying that a token had been configured. Consequently, any request to an @AuthorizationBinding-protected endpoint that supplied an empty `?token=` parameter was accepted as valid, allowing an attacker to bypass authentication and gain unauthorized access to protected resources. This flaw represents a direct authorization bypass and could expose sensitive digitized material.

Versions of intranda Goobi viewer core prior to v26.05 are affected. Systems that deploy the viewer without setting a non‑empty webapi.authorization.token in their configuration are vulnerable.

The CVSS score of 7.4 indicates a high severity. The EPSS score is not available, but the lack of KEV listing suggests no known exploitation in the wild yet. The vulnerability can be exploited by sending an HTTP request to any protected endpoint with an empty `token` query parameter, making the attack surface broad and the exploitation straightforward for an attacker who can reach the application.