CVE-2026-71555 in PILOS
Summary
by MITRE • 08/07/2026
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/07/2026
The PILOS platform serves as a frontend interface for BigBlueButton, facilitating interactive live-online seminars through web-based communication. This system creates a complex attack surface where the interaction between different browsing contexts can introduce significant security vulnerabilities. The vulnerability stems from the absence of proper cross-origin policy enforcement mechanisms within the HTTP response headers, specifically the missing Cross-Origin-Opener-Policy header that should govern how origins interact with each other in web browsers.
The technical flaw manifests when PILOS applications generate links that open new browsing contexts through attributes like target="_blank", which creates a separate window or tab for the destination content. Without the Cross-Origin-Opener-Policy header, these newly opened contexts maintain a window.opener reference back to their originating PILOS tab. This reference allows malicious web pages accessed through such links to programmatically manipulate or redirect the original browsing context using JavaScript APIs available through the window.opener object. The vulnerability represents a classic reverse tabnabbing attack vector where an attacker controls the destination page and can leverage this relationship to compromise the user's session.
The operational impact of this vulnerability extends beyond simple phishing attacks, as it enables sophisticated social engineering campaigns that can exploit authenticated user sessions within PILOS environments. When users navigate from a legitimate PILOS interface to malicious content through these unprotected links, attackers can redirect them to convincing phishing pages that mimic the PILOS interface, potentially capturing credentials or other sensitive information. The vulnerability affects all versions between 2.1.0 and 4.14.1, indicating a prolonged period where users were exposed to this risk without proper mitigation. This issue directly relates to CWE-1038, which addresses cross-origin resource sharing vulnerabilities, and aligns with ATT&CK technique T1566.002 for credential harvesting through phishing attacks.
The remediation implemented in version 4.14.1 addresses the core issue by properly implementing the Cross-Origin-Opener-Policy response header, which prevents the creation of window.opener references when opening new browsing contexts. This solution follows established security best practices recommended by organizations such as the Open Web Application Security Project and aligns with the broader industry standard for preventing reverse tabnabbing attacks. The fix ensures that when users click on external links within PILOS interfaces, any new tabs or windows opened will not maintain references back to the original context, thereby eliminating the attack surface for malicious manipulation of authenticated sessions through this specific vector. Organizations should ensure immediate deployment of version 4.14.1 or later to protect their users from potential exploitation of this vulnerability.