Threats affecting pkg:github/thm-health/PILOS

PILOS, a frontend for BigBlueButton, versions from 2.1.0 up to but not including 4.14.1, does not set the Cross-Origin-Opener-Policy header. This allows pages opened with target="_blank" to retain a window.opener reference, enabling reverse tabnabbing attacks where a malicious page can manipulate the original PILOS tab. The issue is fixed in version 4.14.1.

CVE-2026-22800 is a Cross-Site Request Forgery (CSRF) vulnerability in THM-Health's PILOS platform versions prior to 4.10.0. The vulnerability exists in an administrative API endpoint that terminates all active video conferences on a server via an HTTP GET request. Although authorization checks prevent cross-site exploitation, the use of GET allows same-site content to trigger this destructive action without explicit administrator intent. This can cause disruption by terminating all ongoing video conferences unexpectedly. The vulnerability has a low CVSS score of 2.4 and requires authenticated administrator interaction with crafted content. The issue is fixed in version 4.10.

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session’s token remains valid and is not refreshed. If an attacker has previously obtained this session token through another vulnerability, changing the password will not invalidate their access. As a result, the attacker can continue to act as the user even after the password has been changed. This vulnerability is fixed in 4.8.0.

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s base image. Additionally, the PHP version can also be inferred through the PILOS version displayed in the footer and by examining the source code available on GitHub. This information disclosure vulnerability has been patched in PILOS in v4.8.0.

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper validation or a whitelist, while Access-Control-Allow-Credentials is set to true. This behavior could allow a malicious website on a different origin to send requests (including credentials) to the PILOS API. This may enable exfiltration or actions using the victim’s credentials if the server accepts those cross-origin requests as authenticated. Laravel’s session handling applies additional origin checks such that cross-origin requests are not authenticated by default. Because of these session-origin protections, and in the absence of any other unknown vulnerabilities that would bypass Laravel’s origin/session checks, this reflected-Origin CORS misconfiguration is not believed to be exploitable in typical PILOS deployments. This vulnerability has been patched in PILOS in v4.8.0