CVE-2026-46404mediumCWE-918

CVE-2026-46404: medium-severity vulnerability in bigbluebutton

BigBlueButton: Presentation URL Security Hardening

Published · Updated

Follow this CVE+ Monitor bigbluebutton

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.8epss 0.4%
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0.23.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected products
bigbluebutton · bigbluebutton
Related CVEs — bigbluebutton

In the same product, most dangerous first.

CVE-2022-29169HIGHReDoS on endpoint html5client/useragent in BigBlueButtonEPSS 1.6%CVE-2022-31064MEDIUMCross site scripting in username that will trigger by sending chatEPSS 1.3%CVE-2022-29232MEDIUMExposure of messages in BigBlueButton public chatsEPSS 1.1%CVE-2022-29235MEDIUMLimited data exposure for shared external videos in BigBlueButtonEPSS 1.1%CVE-2022-29233MEDIUMImproper access control for breakout rooms in BigBlue ButtonEPSS 1.1%CVE-2022-29236MEDIUMImproper access control for pencil annotations in BigBlueButtonEPSS 0.9%