Skip to content
OpenAdvisories
High WID-SEC-2026-1568 3 CVEs

BigBlueButton: Mehrere Schwachstellen

Published May 17, 2026 · Updated Jul 16, 2026 · Revision 2 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in BigBlueButton ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen.

Product

BigBlueButton ist ein Open-Source-Web-Konferenzsystem.

Vulnerabilities 3

  • High 8.1
    CVE-2026-46351

    BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them

    BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values with insufficiently secure randomness in bbb-common-web/src/main/java/org/bigbluebutton/api/Util.java and bigbluebutton-web/grails-app/control…

    bigbluebutton bigbluebutton
  • High 8.1
    CVE-2026-46353

    BigBlueButton API checksum bypass via presentationUploadExternalUrl

    BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a …

    bigbluebutton bigbluebutton
  • Medium 6.8
    CVE-2026-46404

    BigBlueButton: Presentation URL Security Hardening

    BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0…

    bigbluebutton bigbluebutton

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-44996, EUVD-2026-44997, EUVD-2026-44998

  2. #1

    Initiale Fassung

References