Executive brief
BigBlueButton is an open-source virtual classroom platform used for online learning and meetings. A security flaw in the recording playback feature allowed malicious users to insert harmful scripts into the public chat during a live session. These scripts would then execute automatically whenever any student or instructor later replayed the recording, potentially allowing the attacker to hijack sessions or steal sensitive information.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the bbb-playback component of BigBlueButton. The root cause is a failure to sanitize user-provided input in the public chat module before it is rendered during recording playback in the presentation format. An attacker with basic participant privileges can inject malicious JavaScript into the chat during a live session. This script is then persisted in the recording and executes in the context of any user who later views the recording playback. The issue is resolved in BigBlueButton version 3.0.19 (which includes bbb-playback 5.4.3) and Scalelite version 1.7.0.
Affected products
- BigBlueButton BigBlueButton < 3.0.19
- BigBlueButton bbb-playback < 5.4.3
- Blindside Networks Scalelite < 1.7.0
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-18: disclosed: NVD publication date
- 2026-05-18: patched: Fix confirmed in version 3.0.19
References
- https://github.com/bigbluebutton/bbb-playback/commit/09e89bfe4ff8488b68c3ff040d3081e419dc89b1
- https://github.com/bigbluebutton/bigbluebutton/commit/69f45aa1b963dc7d80179d0155acc670aec5c4fc
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.19
- https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8vv7-vj94-q2pv
- https://github.com/blindsidenetworks/scalelite/releases/tag/v1.7.0