EUVD-2026-54178Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
PR:L reflects that an authenticated victim is required; S:C captures the cross-origin browser boundary crossed via window.opener; UI:R is mandatory since the user must click the link.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.
AnalysisAI
Reverse tabnabbing in PILOS versions 2.1.0 through 4.14.1 exposes authenticated users to session hijacking via phishing by omitting the Cross-Origin-Opener-Policy (COOP) response header on pages that open links in new browser tabs. When an authenticated user clicks a target="_blank" link within PILOS, the newly opened page retains a live window.opener reference to the original PILOS tab, allowing the destination page to silently redirect that tab to an attacker-controlled site mimicking PILOS login. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the victim must be an authenticated PILOS user (PR:L per CVSS - unauthenticated exploitation is not possible); (2) the victim must actively click a link within PILOS that opens a new browser tab via target="_blank" (UI:R per CVSS - passive exploitation is not possible); and (3) the destination page must be attacker-controlled or attacker-influenced, meaning the attacker must be able to introduce a malicious URL into the user's PILOS context. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N scores 4.1 (Medium), which accurately reflects real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade PILOS to version 4.14.1, released at https://github.com/THM-Health/PILOS/releases/tag/v4.14.1, which resolves the missing COOP header via the refactored recording access controller in commit b50f2bd07c4f4a7d6a9981578238ae3579275d81. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today