What is the CVSS score of CVE-2026-46353?

CVE-2026-46353 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Java are affected by CVE-2026-46353?

BigBlueButton bbb-web component versions prior to 3.0.21 contain an authentication bypass vulnerability (CVE-2026-46353, CVSS 8.1) allowing remote attackers to circumvent the shared-secret checksum…. A patch is available.

How to fix or mitigate CVE-2026-46353?

Within 24 hours, identify and document all BigBlueButton deployments and their current versions to determine exposure scope. Within 7 days, for any instances running versions prior to 3.0.21, implement network-level access controls restricting bbb-web API endpoints to authorized callers only, enable detailed audit logging on CreateMeeting and administrative API calls, and establish monitoring for requests attempting to bypass checksum validation. Within 30 days, upgrade all affected BigBlueButton instances to version 3.0.21 or later.

Java CVE-2026-46353

EUVD-2026-44998 HIGH

Improper Access Control (CWE-284)

2026-07-16 GitHub_M

Authentication Bypass Java Bigbluebutton

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 18:48 vuln.today

Analysis Generated

Jul 16, 2026 - 18:48 vuln.today

CVE Published

Jul 16, 2026 - 18:06 cve.org

HIGH 8.1

DescriptionCVE.org

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some endpoints without a checksum. This issue is fixed in version 3.0.21.

Articles & Coverage 1

News 6 New Java Vulnerabilities - 1 Critical, 5 High, 1 With POC Jul 17, 2026

AnalysisAI

Authentication/access-control bypass in BigBlueButton's bbb-web component (versions prior to 3.0.21) lets remote attackers reach protected API endpoints without a valid checksum by supplying the presentationUploadExternalUrl parameter. BigBlueButton's API is normally guarded by a shared-secret checksum, so bypassing it undermines the core authorization mechanism for calls such as CreateMeeting. No public exploit identified at time of analysis, though the fixing commit is public; CVSS is 8.1 and there is no CISA KEV listing or EPSS signal in the provided data.