bigbluebutton vulnerabilities

CVEs per yearBy the year they were published

1. 202217
2. 20235
3. 20244
4. 20253
5. 202613

Newest CVEs

• CVE-2026-55489

  BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

  bigbluebutton · bigbluebutton

  Medium4.9
• CVE-2026-55491

  BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name

  bigbluebutton · bigbluebutton

  Medium5.4
• CVE-2026-46355

  BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser

  bigbluebutton · bigbluebutton

  High7.1
• CVE-2026-46682

  BigBlueButton: Blind SQL Injection AUTH (Moderator)

  bigbluebutton · bigbluebutton

  High8.5
• CVE-2026-46353

  BigBlueButton API checksum bypass via presentationUploadExternalUrl

  bigbluebutton · bigbluebutton

  High8.1
• CVE-2026-46404

  BigBlueButton: Presentation URL Security Hardening

  bigbluebutton · bigbluebutton

  Medium6.8
• CVE-2026-46351

  BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them

  bigbluebutton · bigbluebutton

  High8.1
• CVE-2026-27737

  BigBlueButton has Stored XSS in bbb-playback replay

  bigbluebutton · bigbluebutton

  Medium6.5
• CVE-2026-41127

  BigBlueButton's missing authorization allows viewer to inject/overwrite captions

  bigbluebutton · bigbluebutton

  Medium6.5
• CVE-2026-41126

  BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"

  bigbluebutton · bigbluebutton

  Medium4.3