An attacker supplying an unsanitized origin query parameter to the IIIF Auth 2.0 endpoints auth/login and auth/token injects the value into the Content‑Security‑Policy header and an HTML response that contains a JavaScript single‑quoted postMessage argument. This causes a malformed CSP that allows framing from an attacker‑controlled domain and enables reflected XSS, allowing malicious scripts to execute in the victim’s browser context. The vulnerability maps to CWE‑79 (XSS), CWE‑113 (Network Protocol Misuse), and CWE‑1336 (Parameter Tampering). The impact includes session hijacking, credential theft, or arbitrary script execution within the application, potentially compromising user data and the integrity of the displayed digitised material.

Intranda Goobi Viewer Core versions from 25.08 up to, but not including, 26.05 are vulnerable. Versions 26.05 and later contain the fix.

The CVSS score of 9.3 indicates a high‑severity flaw that is publicly exploitable via the web. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The flaw can be leveraged remotely without authentication by submitting crafted origin parameters to the auth/login and auth/token endpoints, making it a likely candidate for widespread exploitation.