CVE-2026-27737mediumCWE-79

CVE-2026-27737: medium-severity vulnerability in bigbluebutton

BigBlueButton has Stored XSS in bbb-playback replay

Published · Updated

Follow this CVE+ Monitor bigbluebutton+ Monitor bbb-playback

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.3%
BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording. This issue has been fixed 3.0.19.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
bigbluebutton · bbb-playbackbigbluebutton · bigbluebuttonblindsidenetworks · scalite
Related CVEs — bigbluebutton

In the same product, most dangerous first.

CVE-2022-29169HIGHReDoS on endpoint html5client/useragent in BigBlueButtonEPSS 1.6%CVE-2022-31064MEDIUMCross site scripting in username that will trigger by sending chatEPSS 1.3%CVE-2022-29232MEDIUMExposure of messages in BigBlueButton public chatsEPSS 1.1%CVE-2022-29235MEDIUMLimited data exposure for shared external videos in BigBlueButtonEPSS 1.1%CVE-2022-29233MEDIUMImproper access control for breakout rooms in BigBlue ButtonEPSS 1.1%CVE-2022-29236MEDIUMImproper access control for pencil annotations in BigBlueButtonEPSS 0.9%