CVE-2026-47068: phenixdigital phoenix_storybook auth bypass in ComponentIframeLive

CVE-2026-47068 · Severity: low · CVSS 2.3 · Published 2026-05-20

PhoenixStorybook, a library for documenting Elixir Phoenix components, contains a vulnerability that allows an attacker to hijack communication between a user's browser and the server. By guessing a specific session identifier, an unauthenticated attacker can redirect private control messages and component data to their own session. This could lead to the exposure of sensitive UI state or theme information across different user sessions.

Technologies: Phenix Digital Phoenix Storybook. Vendors: Phenix Digital.

Quick answers

Is CVE-2026-47068 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47068 being exploited in the wild.
How severe is CVE-2026-47068?
Low severity, with a CVSS score of 2.3, published 20 May 2026.
Which products and versions are affected?
Phenix Digital Phoenix Storybook >= 0.4.0, < 1.1.0, 0.4.0 to 1.0.x (before 1.1.0).
Is there a fix for CVE-2026-47068?
A patch was published on 2026-06-09: Version 1.1.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47068 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47068?
Check whether you run Phenix Digital Phoenix Storybook at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in `PhoenixStorybook.Story.ComponentIframeLive.handle_params/3`, which accepts a PubSub topic directly from the `topic` URL query parameter without verifying session ownership. When a user visits a crafted URL, the iframe LiveView broadcasts its process ID (PID) to the attacker-supplied topic. A victim's playground subscribed to that topic will then send subsequent state and control messages (such as variation state and theme switches) to the attacker's process instead of the legitimate iframe. This results in a cross-session information leak and message injection. The issue is fixed in version 1.1.0 by deriving the topic from the server-side session.

Affected products

  • phenixdigital phoenix_storybook >= 0.4.0, < 1.1.0

Identifiers

  • CVE-2026-47068
  • GHSA-mrhx-6pw9-q5fh

Timeline

  • 2026-05-20: advisory: GitHub Advisory published
  • 2026-06-09: patched: Version 1.1.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.