This vulnerability allows an attacker to override the target PubSub topic used for communication between a playground LiveView and its iframe. By supplying a custom topic in the URL query parameter, the attacker’s iframe registers its process on sensitive, session‑specific topics. The victim playground subsequently sends privileged control messages to the attacker’s iframe, enabling unauthorized manipulation of UI state or theme toggling within the victim’s session. The weakness is an authorization bypass that lets an attacker gain control over a user’s private session through a simple URL trick.

Products affected are phenixdigital phoenix_storybook versions prior to 1.1.0, including all releases from 0.4.0 up to but not including 1.1.0. The vulnerability is present in the component handling of iframe URLs and is tied to the shared PhoenixStorybook.PubSub used by the playground.

The CVSS score of 2.3 indicates low overall severity. Exploitation requires an attacker to provide a crafted URL to a victim; no authentication or privileged access is needed. Since the EPSS score is unavailable, the current exploitation probability is uncertain, but the lack of KEV listing suggests no publicly known actively exploited instances. The risk remains low to moderate, though the convenience of exploitation may encourage malicious use. As the threat vector is a simple URL parameter, the attack can be performed remotely via phishing or malicious links.