The vulnerability in phenixdigital phoenix_storybook (versions 0.4.0 before 1.1.0) arises from the 'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 function reading a PubSub topic from the URL query parameter 'topic' without verifying that the topic belongs to the requesting session. This allows an attacker to load an iframe with a victim's topic, causing their iframe process ID to be announced on the victim's topic. Consequently, the victim's playground LiveView sends private control messages intended for itself to the attacker's iframe process, resulting in an authorization bypass through user-controlled key manipulation (CWE-639).

An attacker can cause cross-session message interception by injecting a victim's PubSub topic into the iframe URL parameter, leading to unauthorized receipt of private control messages. The impact is limited by the low CVSS score (2.3), indicating low severity with partial attack complexity and limited impact on confidentiality and integrity. There are no known exploits in the wild. The vulnerability does not allow privilege escalation or remote code execution but can disrupt expected session isolation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, avoid exposing phoenix_storybook instances to untrusted users or networks. Review and restrict access to the affected versions (0.4.0 before 1.1.0). Consider implementing additional validation on PubSub topic parameters to ensure they belong to the requesting session if modifying the source code is feasible.