PT-2025-44055 · Unknown+1 · Bigbluebutton+1

Published 2025-10-27 · Updated 2025-10-28 · CVE-2025-62781

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PILOS versions prior to 4.8.0

Description PILOS, a frontend for BigBlueButton, contains a flaw where changing a local user’s password does not invalidate existing session tokens, except for the current session. An attacker who previously obtained a valid session token can maintain access even after the user changes their password. The issue occurs because the current session’s token remains valid after the password change. This allows continued unauthorized access as the user.

Recommendations Update to version 4.8.0 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2025-62781

GHSA-M8W5-8W3H-72WM

Affected Products

Bigbluebutton

Pilos

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62781.json · Exploit
• https://github.com/THM-Health/PILOS/security/advisories/GHSA-m8w5-8w3h-72wm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62781 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62781 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1983015925776339434 · Twitter Post
• https://t.me/CVEtracker/35907 · Telegram Post