# CVE-2026-46404: BigBlueButton SSRF in presentation URL validation

Source: https://junglewise.ai/threats/cve-2026-46404-bigbluebutton-ssrf-in-presentation-url-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-46404 · Severity: medium · CVSS 6.8 · Published 2026-07-16

BigBlueButton is an open-source virtual classroom platform used for online learning and meetings. A security flaw in how the system handles presentation URLs could allow an authorized user with high-level privileges to access sensitive internal data or services that are normally restricted to the local network. This could lead to the exposure of private internal information, though it requires the attacker to already have administrative or high-level access to the platform.

Technologies: [BigBlueButton](https://junglewise.ai/threats/technologies/bigbluebutton). Vendors: [BigBlueButton](https://junglewise.ai/threats/vendors/bigbluebutton).

## Quick answers

**Is CVE-2026-46404 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46404 being exploited in the wild.

**How severe is CVE-2026-46404?** Medium severity, with a CVSS score of 6.8, published 16 July 2026.

**Which products and versions are affected?** BigBlueButton < 3.0.23.

**Is there a fix for CVE-2026-46404?** A patch was published on 2026-07-16: Fix confirmed in version 3.0.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46404 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-46404?** Check whether you run BigBlueButton at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in BigBlueButton's 'bbb-web' component due to insufficient validation of presentation URLs. Prior to version 3.0.23, the application failed to restrict requests to site-local and link-local IP addresses, and did not properly validate the destination of HTTP redirects. An attacker with high privileges (PR:H) can provide a malicious URL that forces the server to make requests to internal network resources. The vulnerability has been mitigated by pinning resolved IP addresses during redirect following and implementing stricter address validation. Users should upgrade to BigBlueButton 3.0.23 or later.

## Affected products

- BigBlueButton BigBlueButton < 3.0.23

## Timeline

- 2026-05-13: advisory: Original GitHub Security Advisory published
- 2026-07-16: disclosed: NVD publication date
- 2026-07-16: patched: Fix confirmed in version 3.0.23

## References

- [https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27](https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27)
- [https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h](https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h)

## Related threats

- [BigBlueButton stored XSS in recording playback](https://junglewise.ai/threats/cve-2026-55491-bigbluebutton-stored-xss-in-recording-playback)
- [BigBlueButton presentation deletion authorization bypass](https://junglewise.ai/threats/cve-2026-55489-bigbluebutton-presentation-deletion-authorization-bypass)
- [BigBlueButton SQL injection in breakout room visibility query](https://junglewise.ai/threats/cve-2026-46682-bigbluebutton-sql-injection-in-breakout-room-visibility-query)
- [BigBlueButton authentication bypass in API controller](https://junglewise.ai/threats/cve-2026-46355-bigbluebutton-authentication-bypass-in-api-controller)
- [BigBlueButton bbb-web checksum bypass in API request handling](https://junglewise.ai/threats/cve-2026-46353-bigbluebutton-bbb-web-checksum-bypass-in-api-request-handling)