EUVD-2026-63680Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network-accessible endpoint requires meeting-participant foothold (PR:L); session impersonation yields high integrity impact with limited confidentiality gain and no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting because handleJoinExistingUser was a routable controller action rather than a private helper. This issue is fixed in version 3.0.23.
AnalysisAI
Session hijacking in BigBlueButton prior to version 3.0.23 enables authenticated meeting participants to impersonate other active attendees by supplying a target's existingUserID to the inadvertently exposed /bigbluebutton/api/handleJoinExistingUser HTTP endpoint. The root cause is a Grails framework visibility error: the handleJoinExistingUser method was declared with def (public, routable) instead of private, making it directly callable over the network without authorization validation - allowing full session reuse without the target's credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be an authenticated participant in an active BigBlueButton meeting, establishing the low-privilege foothold (PR:L per CVSS vector) required to call the API. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) accurately reflects the attack profile: network-reachable, low complexity, requiring low privilege (meeting participant), with high integrity impact due to full session impersonation and limited confidentiality exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade BigBlueButton to version 3.0.23 or later; the vendor-released patch is confirmed by the GitHub release tag at https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23 and the fix commit at https://github.com/bigbluebutton/bigbluebutton/commit/972b04e474e195cbd708b5b3f0485fe528a1a85b. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all BigBlueButton deployments and identify instances running versions prior to 3.0.23. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bigbluebutton
View allBigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value ca
The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which al
An issue was discovered in BigBlueButton through 2.2.29. Rated high severity (CVSS 7.5), this vulnerability is remotely
The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external inte
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access exte
BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion. Rated high severi
BigBlueButton versions 3.0.21 and below allow remote denial of service when ClamAV is configured following official docu
In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop acce
BigBlueButton before 2.3 does not implement LibreOffice sandboxing. Rated medium severity (CVSS 6.5), this vulnerability
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploade
In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, w
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today