CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

BigBlueButton

product · product:bigbluebutton

Coverage
1
first 2026-05-19 → last 2026-10-21
Latest activity
2026-05-19
BigBlueButton fixes predictable session tokens, an API checksum bypass and an SSRF in bbb-web (3.0.21, 3.0.23)
Peak priority
notable
1 notable
Targets
education
sectors: education · regions: dach
Sources cited
7
3 hosts

Defender insights

What each entry about BigBlueButton tells a defender to do, newest first.

2026-05-19NOTABLEBigBlueButton fixes predictable session tokens, an API checksum bypass and an SSRF in bbb-web (3.0.21, 3.0.23)

Exposure · detection

Story timeline

  1. 2026-05-19BigBlueButton bbb-web before 3.0.21 and 3.0.23: predictable session tokens, an API checksum bypass and an SSRF (CVE-2026-46351, CVE-2026-46353, CVE-2026-46404)
    active-threatsBigBlueButton fixes predictable session tokens, an API checksum bypass and an SSRF in bbb-web (3.0.21, 3.0.23)

Hunting pivots

CVEs
CVE-2026-46351CVE-2026-46353CVE-2026-46404
Releases covered
BigBlueButton
Tags
auth-bypassinfo-disclosurepatch-availablevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Credential AccessExploitation for Credential Access

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-19/bigbluebutton-bbb-web-3-0-21-3-0-23-three-flaws-in-eu-educat · ATT&CK page ↗

Credential Access TA0006

T1212Exploitation for Credential Access×1

Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.

Evidence: 2026-05-19/bigbluebutton-bbb-web-3-0-21-3-0-23-three-flaws-in-eu-educat · ATT&CK page ↗

Entries about BigBlueButton (1)

2026-05-19 · view entry permalink →

NOTABLECVE-2026-46351 +2updatedNATOA2

BigBlueButton bbb-web before 3.0.21 and 3.0.23: predictable session tokens, an API checksum bypass and an SSRF (CVE-2026-46351, CVE-2026-46353, CVE-2026-46404)

BigBlueButton, an open-source virtual classroom, published three security advisories for its bbb-web component on 2026-05-13 (ENISA EUVD-2026-44996; BigBlueButton GHSA-7959-pf2v-xc4h, 2026-05-13; BigBlueButton GHSA-43hc-5g2m-cqff, 2026-05-13; BigBlueButton GHSA-xqm3-6q7q-4v5h, 2026-05-13). Before version 3.0.21, bbb-web generated conference session tokens with insufficiently secure randomness, so a user could determine the session tokens of other users in the same session and impersonate them (CVE-2026-46351) (BigBlueButton GHSA-7959-pf2v-xc4h, 2026-05-13; ENISA EUVD-2026-44996), and supplying a presentationUploadExternalUrl parameter bypassed checksum validation, so any user could send valid requests to some endpoints without a checksum (CVE-2026-46353) (BigBlueButton GHSA-43hc-5g2m-cqff, 2026-05-13; ENISA EUVD-2026-44998). Before 3.0.23, presentation URL validation did not restrict access to site-local and link-local addresses, and the fix also pins resolved IPs when following redirects; BigBlueButton says private-address assets may be compromised if the attacker has gained additional access (CVE-2026-46404) (BigBlueButton GHSA-xqm3-6q7q-4v5h, 2026-05-13; ENISA EUVD-2026-44997). The CVSS 3.1 scores in the CVE records are 8.1 for the first two, with low privileges and no user interaction, and 6.8 for the SSRF, with high privileges and a changed scope (ENISA EUVD-2026-44996; ENISA EUVD-2026-44998; ENISA EUVD-2026-44997). Germany's BSI summarized the set as letting a remote, authenticated attacker bypass security measures and disclose confidential information (translated from German) (BSI WID-SEC-2026-1568, 2026-05-18). No source reports exploitation.

Without the fix it is possible for a user to determine the sesionTokens of other users in the session.

Without this fix it is possible for any user to send valid requests to some endpoints without a checksum.

Private addresses assets may be compromised if the attacker has gained additional access.

BigBlueButton

A remote, authenticated attacker can exploit several vulnerabilities in BigBlueButton to bypass security measures and disclose confidential information.

BSI
Correctionrun 2026-10-21T1148Z-auditactionsaffected_productsbodyclassificationcvesevent_dateevidenceheadlinepriorityregionssectorssourcessourcing_notesummarytechniquestitle

BigBlueButton published the three advisories on 2026-05-13, not 2026-05-17, and BSI's advisory followed on 2026-05-18 (BigBlueButton GHSA-7959-pf2v-xc4h, 2026-05-13; BSI WID-SEC-2026-1568, 2026-05-18). No source names the research networks, Swiss cantonal schools or German education ministries said to run BigBlueButton; BSI describes it only as an open-source web-conferencing system (BSI WID-SEC-2026-1568, 2026-05-18). The checksum bypass lets any user send valid requests to some endpoints without a checksum, rather than arbitrary authenticated API calls (BigBlueButton GHSA-43hc-5g2m-cqff, 2026-05-13), and for the SSRF, which needs a high-privilege user, BigBlueButton says only that private-address assets may be compromised if the attacker has gained additional access (BigBlueButton GHSA-xqm3-6q7q-4v5h, 2026-05-13; ENISA EUVD-2026-44997).

threat19 May 05:00Zmulti-sourceOpen finding →
Sources: BigBlueButton (GHSA-7959-pf2v-xc4h) · BigBlueButton (GHSA-43hc-5g2m-cqff) · BigBlueButton (GHSA-xqm3-6q7q-4v5h) · BSI (WID-SEC-2026-1568) · ENISA EUVD (EUVD-2026-44996) · ENISA EUVD (EUVD-2026-44998) · ENISA EUVD (EUVD-2026-44997)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • euvd.enisa.europa.eu3 (43%)
  • github.com3 (43%)
  • wid.cert-bund.de1 (14%)
All cited sources (7)