CVE-2025-62523 PILOS Misconfigured the Access-Control-Allow-Origin Header
PILOS frontend had a CORS misconfiguration allowing cross-origin requests with credentials, potentially enabling data exfiltration or modification, though mitigated by Laravel session checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-62523?
CVE-2025-62523 is a medium-severity vulnerability in THM-Health PILOS, published on 27 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper validation or a whitelist, while Access-Control-Allow-Credentials is set to true. This behavior could allow a malicious website on a different origin to send requests (including credentials) to the PILOS API. This may enable exfiltration or actions using the victim’s credentials if the server accepts those cross-origin requests as authenticated. Laravel’s session handling applies additional origin checks such that cross-origin requests are not authenticated by default. Because of these session-origin protections, and in the absence of any other unknown vulnerabilities that would bypass Laravel’s origin/session checks, this reflected-Origin CORS misconfiguration is not believed to be exploitable in typical PILOS deployments. This vulnerability has been patched in PILOS in v4.8.0
Weakness: CWE-942
Which versions are affected by CVE-2025-62523?
It affects 1 product.
Products include Thm Pilos.
How do I fix CVE-2025-62523?
No fix has been published for CVE-2025-62523 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-62523 being exploited?
There is no known exploitation of CVE-2025-62523 in the wild and no public exploit code.
Other vulnerabilities in THM-Health PILOS
- CVE-2023-47107 PILOS account takeover through password reset poisoning
- CVE-2025-62524 PILOS Exposes PHP version
- CVE-2025-62781 PILOS is missing session regeneration after password change
- CVE-2026-22800 PILOS affected by a CSRF via GET request allows unintentional termination of all active video conferences
Sources
Also known as GHSA-pgfw-f4mp-5445.