# CVE-2026-46353: BigBlueButton bbb-web checksum bypass in API request handling

Source: https://junglewise.ai/threats/cve-2026-46353-bigbluebutton-bbb-web-checksum-bypass-in-api-request-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-46353 · Severity: high · CVSS 8.1 · Published 2026-07-16

BigBlueButton is an open-source virtual classroom platform used for online learning and web conferencing. A security flaw in the system's web component allows users to bypass mandatory security checks when performing certain actions, such as creating meetings. This could allow an attacker to make unauthorized requests to the server, potentially leading to the exposure of sensitive meeting data or unauthorized modification of session settings.

Technologies: [BigBlueButton](https://junglewise.ai/threats/technologies/bigbluebutton). Vendors: [BigBlueButton](https://junglewise.ai/threats/vendors/bigbluebutton).

## Quick answers

**Is CVE-2026-46353 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46353 being exploited in the wild.

**How severe is CVE-2026-46353?** High severity, with a CVSS score of 8.1, published 16 July 2026.

**Which products and versions are affected?** BigBlueButton < 3.0.21.

**Is there a fix for CVE-2026-46353?** A patch was published on 2026-01-29: Version 3.0.21 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46353 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-46353?** Check whether you run BigBlueButton at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A checksum validation bypass exists in BigBlueButton's bbb-web component prior to version 3.0.21. The vulnerability is located in the API request handling within CreateMeeting.java and ValidationService.java. When the 'presentationUploadExternalUrl' parameter is supplied in an API request, the system fails to properly enforce checksum verification. This allows an authenticated attacker with low privileges to submit valid requests to certain API endpoints without providing a required security checksum, leading to improper access control. The issue is resolved in version 3.0.21.

## Affected products

- BigBlueButton BigBlueButton < 3.0.21

## Timeline

- 2026-01-29: patched: Version 3.0.21 released
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD

## References

- [https://github.com/bigbluebutton/bigbluebutton/commit/36fd1b407488a0c56ce620b91184d5a8aea68b3d](https://github.com/bigbluebutton/bigbluebutton/commit/36fd1b407488a0c56ce620b91184d5a8aea68b3d)
- [https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.21](https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.21)
- [https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-43hc-5g2m-cqff](https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-43hc-5g2m-cqff)

## Related threats

- [BigBlueButton stored XSS in recording playback](https://junglewise.ai/threats/cve-2026-55491-bigbluebutton-stored-xss-in-recording-playback)
- [BigBlueButton presentation deletion authorization bypass](https://junglewise.ai/threats/cve-2026-55489-bigbluebutton-presentation-deletion-authorization-bypass)
- [BigBlueButton SQL injection in breakout room visibility query](https://junglewise.ai/threats/cve-2026-46682-bigbluebutton-sql-injection-in-breakout-room-visibility-query)
- [BigBlueButton authentication bypass in API controller](https://junglewise.ai/threats/cve-2026-46355-bigbluebutton-authentication-bypass-in-api-controller)
- [BigBlueButton SSRF in presentation URL validation](https://junglewise.ai/threats/cve-2026-46404-bigbluebutton-ssrf-in-presentation-url-validation)