Bigbluebutton vulnerabilities
We track 10 vulnerabilities in Bigbluebutton products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on August 20, 2026.
Latest Bigbluebutton vulnerabilities
- 8.5 High severity
bigbluebutton: Improper Neutralization of Special Elements used in an SQL Command
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebutt
- 7.1 High severity
bigbluebutton: Improper Authentication
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to sup
- 8.1 High severity
bigbluebutton: Improper Access Control
BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a u
- 8.1 High severity
bigbluebutton: Use of Insufficiently Random Values
BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values with insufficiently secure randomness in bbb-common-web/src/main/java/org/bigbluebutton/api/Util.java and bigbluebutton-web/grails-app/controll
- 8.2 High severity
bigbluebutton: Exposure of Resource to Wrong Sphere
BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for "Server Customization" on Support for ClamAV as presentation file scanner contains instructions that leave a BBB server vulnerable for Denial of Ser
- 7.5 High severity
bigbluebutton: Improper Check or Handling of Exceptional Conditions
BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed `reactionEmojiId` in t
- 7.5 High severity
bigbluebutton: Improper Check or Handling of Exceptional Conditions
BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's `Choices` response type. By submitting a
- 8.8 High severity
bigbluebutton: Unrestricted Upload of File with Dangerous Type
BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove i
- 7.5 High severity
bigbluebutton: Incorrect Authorization
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams lock setting is not enforced on the backend, which allows an attacker to subscr
- 7.5 High severity
bigbluebutton: Inefficient Regular Expression Complexity
BigBlueButton is an open source web conferencing system. Versions starting with 2.2 and prior to 2.3.19, 2.4.7, and 2.5.0-beta.2 are vulnerable to regular expression denial of service (ReDoS) attacks. By using specific a RegularExpression, an attacker can caus