What is the CVSS score of CVE-2026-46351?

CVE-2026-46351 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of BigBlueButton are affected by CVE-2026-46351?

BigBlueButton versions before 3.0.21 contain a session token prediction vulnerability allowing authenticated conference participants to impersonate other users and access confidential meeting content…. A patch is available.

How to fix or mitigate CVE-2026-46351?

Within 24 hours, conduct a complete audit of BigBlueButton deployments to identify all systems running versions prior to 3.0.21, prioritizing instances that host sensitive or confidential communications. Within 7 days, implement compensating controls including enforcement of aggressive session timeouts (15-30 minute maximum), IP-based session validation to prevent cross-network token reuse, rate limiting on conference join attempts, and network access restrictions to trusted internal networks only where operationally feasible. Subscribe to BigBlueButton security advisories; upon patch release for version 3.0.21 or later, conduct staging validation and plan production rollout to complete within 30 days of availability.

BigBlueButton CVE-2026-46351

EUVD-2026-44996 HIGH

Use of Insufficiently Random Values (CWE-330)

2026-07-16 GitHub_M

Java Information Disclosure Bigbluebutton

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Requires an existing valid session so PR:L; network-reachable token prediction with no user interaction; impersonation breaks confidentiality and integrity (C:H/I:H) but not availability.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 18:46 vuln.today

Analysis Generated

Jul 16, 2026 - 18:46 vuln.today

CVE Published

Jul 16, 2026 - 17:58 cve.org

HIGH 8.1

DescriptionCVE.org

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values with insufficiently secure randomness in bbb-common-web/src/main/java/org/bigbluebutton/api/Util.java and bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy, allowing a session user to predict other users' conference session tokens and impersonate them. This issue is fixed in version 3.0.21.

Articles & Coverage 1

News 6 New Java Vulnerabilities - 1 Critical, 5 High, 1 With POC Jul 17, 2026

AnalysisAI

Session hijacking in BigBlueButton before 3.0.21 lets an authenticated conference participant predict and reuse other users' session tokens to impersonate them. The bbb-web component generated 16-character sessionToken values (and 12-character auth tokens and internal user IDs) using Apache Commons RandomStringUtils.randomAlphanumeric, a non-cryptographic PRNG, making the token space guessable to anyone who already holds a valid session. Rated CVSS 8.1 with high confidentiality and integrity impact; no public exploit identified at time of analysis.

Technical ContextAI

BigBlueButton is an open-source web conferencing / virtual classroom platform built on a Grails (Groovy/Java) web tier (bbb-web). The flaw is CWE-330 (Use of Insufficiently Random Values): token generation in ApiController.groovy called RandomStringUtils.randomAlphanumeric, which by default draws from java.util.Random - a linear congruential PRNG that is not cryptographically secure. An observer of one or more issued tokens can potentially reconstruct the internal PRNG state and predict subsequent sessionToken, authToken, and internalUserID values. The fix commit (8457886) remediates this by introducing a Util.randomAlphanumeric helper backed by java.security.SecureRandom and replacing all three call sites (session token length 16, auth token and user ID length 12). Affected CPE is cpe:2.3:a:bigbluebutton:bigbluebutton.

RemediationAI

Vendor-released patch: 3.0.21 - upgrade BigBlueButton to v3.0.21 or later, which replaces the insecure RandomStringUtils token generation with a java.security.SecureRandom-backed Util.randomAlphanumeric helper (fix commit 8457886c248aeba5597ee8749267602d6d117e98). Review the advisory at https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-7959-pf2v-xc4h before rolling out. If immediate upgrade is not possible, reduce exposure by restricting who can obtain a valid session (enforce moderator approval / waiting-room join, limit guest and anonymous joins, and shorten session and meeting lifetimes so predicted tokens expire faster) and monitor for the same session token being used concurrently from different IPs. These are partial compensating controls only: they narrow the pool of would-be attackers but do not fix the weak PRNG, and tightening join policies may inconvenience legitimate users.