PILOS Password Change Vulnerability Allows Session Hijacking

A vulnerability in PILOS, a frontend for BigBlueButton, prior to version 4.8.0, allows users with a local account to change their password while logged in. When a password is changed, all active sessions are terminated except for the current one. However, the session token remains valid and is not refreshed. This creates an opportunity for an attacker who has previously obtained the session token to maintain access as the user, even after the password has been changed.

Impact

Exploitation of this vulnerability allows for session hijacking, where an attacker can continue to act as the user after the user has changed their password.

Remediation

Users can upgrade to PILOS version 4.8.0 or later to address this vulnerability.