CVE-2026-71555
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.
Risk Assessment
The risk for the organization is the possibility of a phishing attack on authenticated PILOS users, which can lead to theft of login credentials or other sensitive information.
Recommendation
It is recommended to immediately update PILOS to version 4.14.1 or later, which fixes this vulnerability, and to inform users about the risk of opening links from PILOS.
Other vulnerabilities in PILOS
See all- CVE-2025-62781Medium
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to version 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session's token remains valid and is not refreshed. If an attacker has previously obtained this session token through another vulnerability, changing the password will not invalidate their access. As a result, the attacker can continue to act as the user even after the password has been changed. This vulnerability is fixed in version 4.8.0.
- CVE-2025-62524Medium
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits.
- CVE-2025-62523Medium
CORS misconfiguration in PILOS before 4.8.0: reflects the Origin header in Access-Control-Allow-Origin without validation, with Access-Control-Allow-Credentials set to true. However, Laravel's session protections make typical deployments not exploitable.
Original NVD description (English source)
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS