CVE-2026-71555

Received Received - Intake

Reverse Tabnabbing in PILOS Platform

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71555

Affected Vendors & Products

Vendor	Product	Version / Range
pilos	pilos	From 2.1.0 (inc) to 4.14.1 (inc)
pilos	pilos	4.14.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1022	The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.

Attack-Flow Graph

Executive Summary

PILOS versions 2.1.0 to 4.14.0 lack a Cross-Origin-Opener-Policy header. This allows pages opened via PILOS with target=_blank to retain a window.opener reference. Attackers can exploit this to redirect authenticated users to phishing pages that mimic PILOS, a technique called reverse tabnabbing.

Detection Guidance

To detect this vulnerability, check if PILOS sends the Cross-Origin-Opener-Policy header. Use curl to inspect HTTP responses from PILOS: curl -I http://your-pilos-domain.com. If the header is missing, the system is vulnerable. Compare the version against 4.14.1 to confirm exposure.

Impact Analysis

If you use PILOS versions 2.1.0 to 4.14.0, an attacker could trick you into visiting a malicious site that takes over your PILOS session. This could lead to unauthorized actions or theft of sensitive data if you are logged in.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing sensitive information through phishing attacks.

Mitigation Strategies

Upgrade PILOS to version 4.14.1 or later immediately. If upgrading is not possible, configure your web server to add the Cross-Origin-Opener-Policy header with a value of same-origin to all PILOS responses.

Hi! I’m here to help you understand CVE-2026-71555. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70