# cve.now: Bigbluebutton

The newest entries naming Bigbluebutton as an affected vendor (up to 200), of 42 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-55489](https://cve.now/CVE-2026-55489.md): BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass (CVSS 4.9)
- [CVE-2026-55491](https://cve.now/CVE-2026-55491.md): BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name (CVSS 5.4)
- [CVE-2026-46355](https://cve.now/CVE-2026-46355.md): BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser (CVSS 7.1)
- [CVE-2026-46682](https://cve.now/CVE-2026-46682.md): BigBlueButton: Blind SQL Injection AUTH (Moderator) (CVSS 8.5)
- [CVE-2026-46353](https://cve.now/CVE-2026-46353.md): BigBlueButton API checksum bypass via presentationUploadExternalUrl (CVSS 8.1)
- [CVE-2026-46404](https://cve.now/CVE-2026-46404.md): BigBlueButton: Presentation URL Security Hardening (CVSS 6.8)
- [CVE-2026-46351](https://cve.now/CVE-2026-46351.md): BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them (CVSS 8.1)
- [CVE-2026-27737](https://cve.now/CVE-2026-27737.md): BigBlueButton has Stored XSS in bbb-playback replay (CVSS 6.5)
- [CVE-2026-41127](https://cve.now/CVE-2026-41127.md): BigBlueButton's missing authorization allows viewer to inject/overwrite captions (CVSS 6.5)
- [CVE-2026-41126](https://cve.now/CVE-2026-41126.md): BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL" (CVSS 4.3)
- [CVE-2026-27736](https://cve.now/CVE-2026-27736.md): BigBlueButton has Open Redirect vulnerability in ApiController (CVSS 6.1)
- [CVE-2026-27467](https://cve.now/CVE-2026-27467.md): BigBlueButton: Audio from participants to the server initially unmuted (CVSS 2.0)
- [CVE-2026-27466](https://cve.now/CVE-2026-27466.md): BigBlueButton: Exposed ClamAV port enables Denial of Service (CVSS 7.2)
- [CVE-2025-61602](https://cve.now/CVE-2025-61602.md): BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId (CVSS 7.5)
- [CVE-2025-61601](https://cve.now/CVE-2025-61601.md): BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation (CVSS 7.5)
- [CVE-2025-55200](https://cve.now/CVE-2025-55200.md): BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes (CVSS 7.1)
- [CVE-2024-39302](https://cve.now/CVE-2024-39302.md): Some bbb-record-core files installed with wrong file permission (CVSS 3.7)
- [CVE-2024-38518](https://cve.now/CVE-2024-38518.md): bbb-web API additional parameters considered (CVSS 4.6)
- [CVE-2022-36029](https://cve.now/CVE-2022-36029.md): BigBlueButton Greenlight Open Redirect vulnerability (CVSS 9.1)
- [CVE-2022-36028](https://cve.now/CVE-2022-36028.md): BigBlueButton Greenlight Open Redirect vulnerability (CVSS 9.1)
- [CVE-2023-43798](https://cve.now/CVE-2023-43798.md): BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass) (CVSS 5.6)
- [CVE-2023-43797](https://cve.now/CVE-2023-43797.md): BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby (CVSS 6.3)
- [CVE-2023-42804](https://cve.now/CVE-2023-42804.md): BigBlueButton Path Traversal – Reading Certain File Extensions (CVSS 3.1)
- [CVE-2023-42803](https://cve.now/CVE-2023-42803.md): BigBlueButton Unrestricted File Upload vulnerability (CVSS 5.3)
- [CVE-2023-33176](https://cve.now/CVE-2023-33176.md): Blind SSRF When Uploading Presentation in BigBlueButton (CVSS 4.8)
- [CVE-2022-23488](https://cve.now/CVE-2022-23488.md): BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data (CVSS 6.5)
- [CVE-2022-23490](https://cve.now/CVE-2022-23490.md): Improper access control to polling votes (CVSS 4.3)
- [CVE-2022-41964](https://cve.now/CVE-2022-41964.md): BigBlueButton contains Response leaks in anonymous polls (CVSS 5.7)
- [CVE-2022-41963](https://cve.now/CVE-2022-41963.md): BigBlueButton contains Improper Preservation of Permissions for whiteboard (CVSS 2.7)
- [CVE-2022-41962](https://cve.now/CVE-2022-41962.md): BigBlueButton contains Incorrect Authorization for setting emoji status (CVSS 2.7)
- [CVE-2022-41961](https://cve.now/CVE-2022-41961.md): BigBlueButton subject to Ineffective user bans (CVSS 4.3)
- [CVE-2022-41960](https://cve.now/CVE-2022-41960.md): BigBlueButton contains DoS via failed authToken validation (CVSS 4.3)
- [CVE-2022-31064](https://cve.now/CVE-2022-31064.md): Cross site scripting in username that will trigger by sending chat (CVSS 6.5)
- [CVE-2022-31065](https://cve.now/CVE-2022-31065.md): Cross site scripting vulnerability for private chat in bigbluebutton (CVSS 6.5)
- [CVE-2022-31039](https://cve.now/CVE-2022-31039.md): Improper privilege management - Anyone can view room settings in GreenLight (CVSS 4.3)
- [CVE-2022-29235](https://cve.now/CVE-2022-29235.md): Limited data exposure for shared external videos in BigBlueButton (CVSS 5.3)
- [CVE-2022-29236](https://cve.now/CVE-2022-29236.md): Improper access control for pencil annotations in BigBlueButton (CVSS 4.3)
- [CVE-2022-29234](https://cve.now/CVE-2022-29234.md): Grace period for lock settings in public/private chats in BigBlueButton (CVSS 4.3)
- [CVE-2022-29233](https://cve.now/CVE-2022-29233.md): Improper access control for breakout rooms in BigBlue Button (CVSS 4.3)
- [CVE-2022-29232](https://cve.now/CVE-2022-29232.md): Exposure of messages in BigBlueButton public chats (CVSS 6.5)
- [CVE-2022-29169](https://cve.now/CVE-2022-29169.md): ReDoS on endpoint html5client/useragent in BigBlueButton (CVSS 7.5)
- [CVE-2021-4143](https://cve.now/CVE-2021-4143.md): Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton (CVSS 8.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/bigbluebutton
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.