The flaw occurs in the JWT verification routine of the Goobi viewer application, where the auditor does not enforce the audience claim during cryptographic validation. Tokens issued for one relying party that happen to have the same audience string as the viewer’s client ID pass a later manual check that only compares a single string value. As a result, an attacker can forge or obtain a token that is valid for a different RP but contains the viewer’s client ID in the aud field, allowing the viewer to authenticate the attacker as the token’s subject instead of the legitimate user.

The vulnerability is present in intranda’s Goobi viewer core from version 25.01 up to, but excluding, 26.05. The fix was applied in release v26.05, which restores proper audience verification in the JWT verifier.

With a CVSS score of 7.4 the vulnerability is considered high severity but the EPSS score is not available and the weakness is not listed in CISA’s KEV catalog. The exploitation path requires that an attacker can create or obtain a JWT that matches the viewer’s client ID audience, which is achievable if the attacker can interact with the operating identity provider or compromise a token issuance process. Once a valid token is presented, the viewer will accept the attacker as an authenticated user, enabling unauthorized access to any protected resources within the application, including viewing or manipulating digitised content.