CVE-2026-71555
CVE-2026-71555 is a medium-severity vulnerability with a CVSS 3.x base score of 4.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1022.
Key facts
- Severity: Medium (CVSS 3.x base score 4.1)
- EPSS exploit prediction: 0% (7th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-1022
- Published:
- Last modified:
Description
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.
Frequently asked questions
- What is CVE-2026-71555?
- PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.
- How severe is CVE-2026-71555?
- CVE-2026-71555 has a CVSS 3.x base score of 4.1, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.
- Is CVE-2026-71555 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-71555?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-71555 published?
- CVE-2026-71555 was published on 2026-08-06 and last updated on 2026-08-07.
References
- https://github.com/THM-Health/PILOS/commit/b50f2bd07c4f4a7d6a9981578238ae3579275d81
- https://github.com/THM-Health/PILOS/releases/tag/v4.14.1
- https://github.com/THM-Health/PILOS/security/advisories/GHSA-j4wr-p8gh-xrw5
Other CWE-1022 vulnerabilities
- CVE-2022-1583 — Medium (CVSS 6.5): The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null"…
- CVE-2020-36624 — Medium (CVSS 6.3): A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability…
- CVE-2024-39727 — Medium (CVSS 6.1): IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted…
- CVE-2022-4927 — Medium (CVSS 5.5): A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some…
- CVE-2025-33014 — Medium (CVSS 5.4): IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a…
- CVE-2022-2600 — Medium (CVSS 5.4): The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which…