Is CVE-2026-46351 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46351 being exploited in the wild.

How severe is CVE-2026-46351?

High severity, with a CVSS score of 8.1, published 16 July 2026.

Is there a fix for CVE-2026-46351?

A patch was published on 2026-01-29: Version 3.0.21 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46351 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-46351?

Check whether you run BigBlueButton at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46351: BigBlueButton insecure randomness in sessionToken generation

CVE-2026-46351 · Severity: high · CVSS 8.1 · Published 2026-07-16

BigBlueButton is an open-source virtual classroom platform used for online learning and web conferencing. A security flaw in how the system generates session tokens allows an attendee to predict the secret tokens of other participants. An attacker could use this to impersonate other users, potentially gaining unauthorized access to private meetings or sensitive student information.

Technologies: BigBlueButton. Vendors: BigBlueButton.

Quick answers

Is CVE-2026-46351 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46351 being exploited in the wild.
How severe is CVE-2026-46351?: High severity, with a CVSS score of 8.1, published 16 July 2026.
Which products and versions are affected?: BigBlueButton < 3.0.21.
Is there a fix for CVE-2026-46351?: A patch was published on 2026-01-29: Version 3.0.21 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46351 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-46351?: Check whether you run BigBlueButton at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in BigBlueButton's session management due to the use of insufficiently secure randomness (CWE-330) when generating sessionToken values. The issue is located in bbb-common-web/src/main/java/org/bigbluebutton/api/Util.java and bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A remote attacker with low privileges (an authenticated session user) can predict the tokens of other participants because the PRNG used was not cryptographically secure. This allows for session hijacking and user impersonation. The vulnerability is fixed in version 3.0.21 by implementing a SecureRandom PRNG for ID and token generation.

Affected products

BigBlueButton BigBlueButton < 3.0.21

Timeline

2026-01-29: patched: Version 3.0.21 released
2026-05-13: advisory: GitHub Security Advisory published
2026-07-16: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.