Is CVE-2026-46353 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46353 being exploited in the wild.

How severe is CVE-2026-46353?

High severity, with a CVSS score of 8.1, published 16 July 2026.

Is there a fix for CVE-2026-46353?

A patch was published on 2026-01-29: Version 3.0.21 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46353 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-46353?

Check whether you run BigBlueButton at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46353: BigBlueButton bbb-web checksum bypass in API request handling

CVE-2026-46353 · Severity: high · CVSS 8.1 · Published 2026-07-16

BigBlueButton is an open-source virtual classroom platform used for online learning and web conferencing. A security flaw in the system's web component allows users to bypass mandatory security checks when performing certain actions, such as creating meetings. This could allow an attacker to make unauthorized requests to the server, potentially leading to the exposure of sensitive meeting data or unauthorized modification of session settings.

Technologies: BigBlueButton. Vendors: BigBlueButton.

Quick answers

Is CVE-2026-46353 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46353 being exploited in the wild.
How severe is CVE-2026-46353?: High severity, with a CVSS score of 8.1, published 16 July 2026.
Which products and versions are affected?: BigBlueButton < 3.0.21.
Is there a fix for CVE-2026-46353?: A patch was published on 2026-01-29: Version 3.0.21 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46353 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-46353?: Check whether you run BigBlueButton at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A checksum validation bypass exists in BigBlueButton's bbb-web component prior to version 3.0.21. The vulnerability is located in the API request handling within CreateMeeting.java and ValidationService.java. When the 'presentationUploadExternalUrl' parameter is supplied in an API request, the system fails to properly enforce checksum verification. This allows an authenticated attacker with low privileges to submit valid requests to certain API endpoints without providing a required security checksum, leading to improper access control. The issue is resolved in version 3.0.21.

Affected products

BigBlueButton BigBlueButton < 3.0.21

Timeline

2026-01-29: patched: Version 3.0.21 released
2026-05-13: advisory: GitHub Security Advisory published
2026-07-16: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.