PILOS CVE-2026-71555

Exploitation requires three concurrent conditions: (1) the victim must be an authenticated PILOS user (PR:L per CVSS - unauthenticated exploitation is not possible); (2) the victim must actively click a link within PILOS that opens a new browser tab via target="_blank" (UI:R per CVSS - passive exploitation is not possible); and (3) the destination page must be attacker-controlled or attacker-influenced, meaning the attacker must be able to introduce a malicious URL into the user's PILOS context. Exploitation is limited by the requirement for authenticated user interaction, the need for the attacker to plant or influence a reachable URL within PILOS, and the progressive browser-side noopener defaults in Chrome 83+ and Firefox 79+ which reduce but do not eliminate the window.opener exposure. Versions 4.14.1 and later are not exploitable.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N scores 4.1 (Medium), which accurately reflects real-world risk. PR:L confirms that exploitation requires an authenticated victim, not an anonymous internet attacker. UI:R adds a meaningful barrier - the user must actively click a link. The Scope Change (S:C) captures the cross-origin browser boundary being crossed, distinguishing this from a purely internal impact. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. The absence of a CISA KEV listing and any public POC indicates no confirmed mass exploitation. The primary threat model is targeted phishing of authenticated PILOS users - the attacker does not gain direct server-side access but can harvest credentials via a convincing fake login page. For most deployments, this is a patch-in-normal-cycle issue rather than an emergency. Note that modern browsers (Chrome 83+, Firefox 79+) have introduced implicit noopener behavior for some target="_blank" scenarios, which may independently reduce exploitability on updated client browsers, but relying on this is not a reliable mitigation.

An attacker hosts a malicious page and introduces its URL into a PILOS session - for example, as a meeting link, shared room file reference, or external recording resource. An authenticated PILOS user clicks the link, which opens in a new browser tab; the malicious page immediately executes window.opener.location.href = 'https://pilos-phishing.attacker.com', redirecting the original authenticated PILOS tab to a convincing credential-harvesting login page. No public exploit code has been identified at time of analysis.