Disclosure summary
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently active one. However, the current session’s token remains valid and is not refreshed. If an attacker has previously obtained this session token through another vulnerability, changing the password will not invalidate their access. As a result, the attacker can continue to act as the user even after the password has been changed. This vulnerability is fixed in 4.8.0.
Source-reported weakness categories
CWE-613
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2025-62781
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| thm | pilos | * {"versionEndExcluding":"4.8.0"} |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Vendor Advisory
PUBLISHED 2025-10-27T18:15:42-04:00
MODIFIED 2026-10-08T07:10:00-04:00
INGESTED 2026-10-08T12:35:13-04:00