Bigbluebutton vulnerabilities
42 CVEs and advisories name Bigbluebutton as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-55489BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass
- CVE-2026-55491BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
- CVE-2026-46355BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
- CVE-2026-46682BigBlueButton: Blind SQL Injection AUTH (Moderator)
- CVE-2026-46353BigBlueButton API checksum bypass via presentationUploadExternalUrl
- CVE-2026-46404BigBlueButton: Presentation URL Security Hardening
- CVE-2026-46351BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them
- CVE-2026-27737BigBlueButton has Stored XSS in bbb-playback replay
- CVE-2026-41127BigBlueButton's missing authorization allows viewer to inject/overwrite captions
- CVE-2026-41126BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"
- CVE-2026-27736BigBlueButton has Open Redirect vulnerability in ApiController
- CVE-2026-27467BigBlueButton: Audio from participants to the server initially unmuted
- CVE-2026-27466BigBlueButton: Exposed ClamAV port enables Denial of Service
- CVE-2025-61602BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId
- CVE-2025-61601BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation
- CVE-2025-55200BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes
- CVE-2024-39302Some bbb-record-core files installed with wrong file permission
- CVE-2024-38518bbb-web API additional parameters considered
- CVE-2022-36029BigBlueButton Greenlight Open Redirect vulnerability
- CVE-2022-36028BigBlueButton Greenlight Open Redirect vulnerability
- CVE-2023-43798BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)
- CVE-2023-43797BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
- CVE-2023-42804BigBlueButton Path Traversal – Reading Certain File Extensions
- CVE-2023-42803BigBlueButton Unrestricted File Upload vulnerability
- CVE-2023-33176Blind SSRF When Uploading Presentation in BigBlueButton
- CVE-2022-23488BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data
- CVE-2022-23490Improper access control to polling votes
- CVE-2022-41964BigBlueButton contains Response leaks in anonymous polls
- CVE-2022-41963BigBlueButton contains Improper Preservation of Permissions for whiteboard
- CVE-2022-41962BigBlueButton contains Incorrect Authorization for setting emoji status