Executive brief
BigBlueButton is an open-source virtual classroom platform used for online learning and web conferencing. A security flaw in how the system generates session tokens allows an attendee to predict the secret tokens of other participants. An attacker could use this to impersonate other users, potentially gaining unauthorized access to private meetings or sensitive student information.
Technical details
A vulnerability exists in BigBlueButton's session management due to the use of insufficiently secure randomness (CWE-330) when generating sessionToken values. The issue is located in bbb-common-web/src/main/java/org/bigbluebutton/api/Util.java and bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A remote attacker with low privileges (an authenticated session user) can predict the tokens of other participants because the PRNG used was not cryptographically secure. This allows for session hijacking and user impersonation. The vulnerability is fixed in version 3.0.21 by implementing a SecureRandom PRNG for ID and token generation.
Affected products
- BigBlueButton BigBlueButton < 3.0.21
Timeline
- 2026-01-29: patched: Version 3.0.21 released
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD