Description

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., target="_blank") retain a window.opener reference back to the originating PILOS tab. A malicious destination page reached this way can use window.opener to navigate or manipulate the original PILOS tab, a technique known as reverse tabnabbing, potentially redirecting an authenticated user to a phishing page that mimics PILOS. This issue is fixed in version 4.14.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-08-06T22:18:32.553Z",
  "pubdate": "2026-08-06T22:18:32.553Z",
  "executiveSummary": "PILOS (Platform for Interactive Live-Online Seminars) versions 2.1.0 through 4.14.1 suffer from a reverse tabnabbing vulnerability caused by the omission of the Cross-Origin-Opener-Policy response header.\nWhen authenticated users click links that open external resources in a new browsing context via target=\"_blank\", the newly created destination page retains a valid window.opener DOM reference pointing back to the originating PILOS tab.\nA malicious destination page can leverage this reference to manipulate the DOM, access properties, or forcibly redirect the original PILOS tab to an attacker-controlled phishing interface.\nThis exposes active sessions to credential harvesting and unauthorized actions if users interact with untrusted external links.\nThe attack requires user interaction in the form of clicking a crafted link originating from the vulnerable application, but does not require prior authentication on the destination domain.\nThe vulnerability is fully resolved in version 4.14.1 by implementing appropriate header policies.",
  "technicalDetails": "The root cause of this vulnerability is the absence of the Cross-Origin-Opener-Policy (COOP) response header across web responses generated by the PILOS (Platform for Interactive Live-Online Seminars) application in affected versions 2.1.0 to 4.14.1.\nModern web browsers allow links containing target=\"_blank\" or similar mechanisms to instantiate new browsing contexts. By default, unless isolated by security headers, the newly opened browsing context retains a JavaScript reference (window.opener) to the originating document.\nThis reference grants the target document synchronous access to the window object of the opener context, allowing the execution of methods such as window.opener.location.replace() to silently navigate the user away from the legitimate application.\nIn a typical attack flow, an authenticated user interacts with content inside PILOS that links to an external, attacker-controlled web server.\nUpon navigation, the malicious destination page executes JavaScript code targeting the window.opener reference.\nThe malicious script redirects the original PILOS tab to a sophisticated phishing page visually identical to the authentic PILOS login or dashboard interface.\nUnaware of the redirection due to the seamless nature of the tab manipulation, the user enters credentials or sensitive session data into the fraudulent interface, resulting in session hijacking and credential compromise.\nThe vulnerable component is the HTTP response header configuration of the PILOS frontend application.\nThe vulnerability affects all deployments running versions 2.1.0 up to and including 4.14.1.\nThe attack vector is network-based, requiring the victim to be authenticated and actively navigating to an external malicious link presented within the platform."
}