What is the CVSS score of CVE-2026-46404?

CVE-2026-46404 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-46404?

Yes, a patch is available for CVE-2026-46404. Update the affected software to the latest version immediately.

BigBlueButton CVE-2026-46404

EUVD-2026-44997 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-16 GitHub_M

SSRF Bigbluebutton

6.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.3 MEDIUM

AC:H reflects DNS rebinding setup requirement; PR:L because meeting presenter roles are low-privilege in typical BBB deployments, not admin.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 18:46 vuln.today

Analysis Generated

Jul 16, 2026 - 18:46 vuln.today

DescriptionCVE.org

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0.23.

AnalysisAI

Server-side request forgery in BigBlueButton's presentation URL handling allows privileged users to probe internal network resources before version 3.0.23. The presentation URL validation failed to block site-local (RFC 1918) and link-local (169.254.x.x) address ranges, and critically, the redirect-following logic did not pin resolved IP addresses, enabling DNS rebinding attacks that bypass initial validation. No public exploit has been identified at time of analysis, and the EPSS signal is absent from provided data, but the scope-change in the CVSS vector confirms the attack crosses from the BBB application tier into the broader internal network.

Technical ContextAI

BigBlueButton (CPE: cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*) is an open-source Java-based virtual classroom platform. The affected component is the RedirectFollowerService within bbb-common-web, which fetches external presentation URLs on behalf of meeting participants. The root cause (CWE-918: Server-Side Request Forgery) manifests in two complementary weaknesses: first, the URL validator did not explicitly blocklist site-local (10.x.x.x, 172.16.x.x, 192.168.x.x) and link-local (169.254.x.x) address ranges; second, and more critically, the old followRedirect method performed no IP pinning, meaning an attacker-controlled DNS server could return a benign public IP at validation time, then rebind to an internal address for the actual HTTP connection-a classic SSRF-via-DNS-rebinding pattern. The fix introduces a ValidatedUrl record that captures resolved InetAddress[] at validation time, a custom pinned DnsResolver that blocks resolution for any host not matching the pre-validated host, and a new followRedirectSecure method that enforces these constraints throughout the redirect chain.

RemediationAI

Upgrade to BigBlueButton 3.0.23 or later, which introduces IP-pinned redirect following and explicit blocklisting of site-local and link-local address ranges. The upstream fix commit is available at https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27 and the advisory is at https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h. If immediate patching is not possible, a compensating control is to enforce egress firewall rules on the BBB application server host that deny outbound TCP connections to RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local (169.254.0.0/16), including the AWS/GCP/Azure instance metadata endpoint 169.254.169.254; this blocks the most impactful SSRF targets but does not prevent probing of other internet-facing internal services and will break any legitimate use of internal presentation servers. Additionally, restrict the presenter and moderator roles to known-trusted users to reduce the attack surface until the patch is applied.