Skip to main content

BigBlueButton CVE-2026-55491

| EUVDEUVD-2026-63682 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-20 GitHub_M
XSS Bigbluebutton
5.4
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
vuln.today AI
5.4 MEDIUM

PR:L confirmed as attacker must authenticate and create a meeting; UI:R and S:C reflect stored XSS executing in a different user's browser; no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 20, 2026 - 23:11 vuln.today
Analysis Generated
Aug 20, 2026 - 23:11 vuln.today
Patch available
Aug 20, 2026 - 22:04 EUVD

DescriptionCVE.org

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script content, and the script executed in another user's browser when that user replayed the recording. This issue is fixed in version 3.0.29.

AnalysisAI

Stored cross-site scripting in BigBlueButton's screenshare recording playback allows an authenticated low-privileged user to inject arbitrary script via a crafted meeting name, which executes in any other user's browser upon viewing the screenshare recording. Affected versions are all BigBlueButton releases prior to 3.0.29; the vulnerability is rooted in unescaped ERB interpolation of meetingName into both the page title and heading of index.html.erb. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a BigBlueButton account with sufficient permissions to create a meeting and set its name - typically any registered user in standard configurations. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS 5.4 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N accurately models the threat: network-exploitable, low complexity, authenticated attacker (PR:L), victim must open the playback (UI:R), with scope change (S:C) reflecting that the payload executes in a different user's browser context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to BigBlueButton 3.0.29, confirmed at the vendor-tagged release https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.29 and fix commit a53f2b92022388bfa4109d3136d1f3a932404b1b. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Bigbluebutton

View all
CVE-2020-27605 CRITICAL POC
9.8 Oct 21

BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject

CVE-2020-12443 CRITICAL POC
9.8 Apr 29

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value ca
CVE-2020-26163 HIGH POC
8.8 Sep 30

BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover
CVE-2020-27613 HIGH POC
8.4 Oct 21

The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which al
CVE-2020-29043 HIGH POC
7.5 Nov 26

An issue was discovered in BigBlueButton through 2.2.29. Rated high severity (CVSS 7.5), this vulnerability is remotely

CVE-2020-27610 HIGH POC
7.5 Oct 21

The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external inte
CVE-2020-27603 HIGH POC
7.5 Oct 21

BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access exte
CVE-2020-12112 HIGH POC
7.5 Apr 23

BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion. Rated high severi
CVE-2026-27466 HIGH POC
7.2 Feb 21

BigBlueButton versions 3.0.21 and below allow remote denial of service when ClamAV is configured following official docu
CVE-2020-27607 MEDIUM POC
6.5 Oct 21

In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop acce
CVE-2020-27604 MEDIUM POC
6.5 Oct 21

BigBlueButton before 2.3 does not implement LibreOffice sandboxing. Rated medium severity (CVSS 6.5), this vulnerability
CVE-2020-25820 MEDIUM POC
6.5 Oct 21

BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploade

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-55491 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy