Cross-Origin Vulnerability in PILOS Affecting BigBlueButton Users
CVE-2026-71555

4.1MEDIUM

Key Information:

Vendor

Thm-health

Status
Pilos
Vendor
CVE Published:
6 August 2026

What is CVE-2026-71555?

PILOS (Platform for Interactive Live-Online Seminars), which serves as a frontend for BigBlueButton, exhibits a security flaw in versions 2.1.0 through 4.14.0. This vulnerability arises due to the absence of a Cross-Origin-Opener-Policy response header. When a link is activated that opens a new browsing context (like using target='_blank'), the original PILOS tab maintains a window.opener reference. A malicious page can exploit this reference to manipulate or redirect users, potentially leading them to a phishing site that mimics the legitimate PILOS interface. This vulnerability has been addressed in version 4.14.1, enhancing the security posture of PILOS.

Affected Version(s)

PILOS >= 2.1.0, < 4.14.1

References

https://github.com/THM-Health/PILOS/security/advisories/G...
x_refsource_CONFIRM
https://github.com/THM-Health/PILOS/commit/b50f2bd07c4f4a...
x_refsource_MISC
https://github.com/THM-Health/PILOS/releases/tag/v4.14.1
x_refsource_MISC

CVSS V3.1

Score:
4.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.