CVE-2025-62781
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to version 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session's token remains valid and is not refreshed. If an attacker has previously obtained this session token through another vulnerability, changing the password will not invalidate their access. As a result, the attacker can continue to act as the user even after the password has been changed. This vulnerability is fixed in version 4.8.0.
Risk Assessment
The risk is that an attacker who has obtained a session token can retain access to the user's account even after the password is changed, potentially leading to unauthorized access to data and actions in the system.
Recommendation
It is recommended to immediately upgrade PILOS to version 4.8.0 or later to eliminate the vulnerability. Additionally, consider enforcing session token refresh after password changes.
Other vulnerabilities in PILOS
See all- CVE-2026-71555Medium
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.
- CVE-2025-62524Medium
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits.
- CVE-2025-62523Medium
CORS misconfiguration in PILOS before 4.8.0: reflects the Origin header in Access-Control-Allow-Origin without validation, with Access-Control-Allow-Credentials set to true. However, Laravel's session protections make typical deployments not exploitable.
Original NVD description (English source)
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session’s token remains valid and is not refreshed. If an attacker has previously obtained this session token through another vulnerability, changing the password will not invalidate their access. As a result, the attacker can continue to act as the user even after the password has been changed. This vulnerability is fixed in 4.8.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS