Goobi Viewer Reflected XSS via IIIF Auth Origin Parameter

The Goobi viewer is a web application for displaying digitised material in a web browser. In versions 25.08 through before 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource contain a reflected XSS vulnerability.

The endpoints accept an origin query parameter without validation. The unescaped value is embedded into the Content-Security-Policy: frame-ancestors response header and into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls, this can be exploited.

• Affected versions: 25.08 to before 26.05
• Patched version: 26.05