BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.

Published Oct 21, 2020 · Updated Aug 4, 2024 · Assigned by mitre