Executive brief
BigBlueButton is an open-source virtual classroom platform used for online learning and web conferencing. A security flaw in the system's web component allows users to bypass mandatory security checks when performing certain actions, such as creating meetings. This could allow an attacker to make unauthorized requests to the server, potentially leading to the exposure of sensitive meeting data or unauthorized modification of session settings.
Technical details
A checksum validation bypass exists in BigBlueButton's bbb-web component prior to version 3.0.21. The vulnerability is located in the API request handling within CreateMeeting.java and ValidationService.java. When the 'presentationUploadExternalUrl' parameter is supplied in an API request, the system fails to properly enforce checksum verification. This allows an authenticated attacker with low privileges to submit valid requests to certain API endpoints without providing a required security checksum, leading to improper access control. The issue is resolved in version 3.0.21.
Affected products
- BigBlueButton BigBlueButton < 3.0.21
Timeline
- 2026-01-29: patched: Version 3.0.21 released
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD