BigBlueButton CVE-2026-46351

The attacker must first hold a valid conference session on the target BigBlueButton server (PR:L) - i.e., be able to join a meeting as a participant - because prediction relies on the same weak java.util.Random-based generator that issues tokens for other users. Exploitation is limited to versions prior to 3.0.21 and requires observing or brute-forcing within the reduced token entropy of RandomStringUtils.randomAlphanumeric; it does not require user interaction or admin/moderator privileges. Deployments that gate meeting access (approval or waiting rooms, no guest or anonymous join) meaningfully raise the bar, since an attacker cannot easily obtain the prerequisite session.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) indicates network-reachable, low-complexity exploitation by an attacker who already holds low-level privileges - i.e., a legitimate session user, which matches the description of 'a session user' predicting others' tokens. No EPSS score, KEV listing, or POC is present in the provided data, so this is a high-CVSS finding without confirmed real-world exploitation: priority is elevated but not emergency. The practical difficulty of exploiting a java.util.Random-based token depends on how many tokens an attacker can observe and how much entropy remains after seeding, so reliable prediction may require favorable conditions, which tempers the raw score. Because successful impersonation compromises both confidentiality (C:H) and integrity (I:H) of another user's session, this remains a legitimate priority for any internet-exposed BBB deployment even absent evidence of active exploitation.

An attacker joins a meeting as an ordinary participant, obtaining a valid session and observing the format and values of issued tokens. Knowing that tokens come from a non-cryptographic java.util.Random, the attacker predicts another participant's (e.g., a moderator's) 16-character sessionToken and reuses it to impersonate that user within the conference. No public exploit code is identified, and exploitation requires an existing valid session (PR:L) but no user interaction.