CVE-2026-46355

Received Received - Intake

Session Impersonation in BigBlueButton

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting because handleJoinExistingUser was a routable controller action rather than a private helper. This issue is fixed in version 3.0.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-46355

Affected Vendors & Products

Vendor	Product	Version / Range
bigbluebutton	bigbluebutton	3.0.23

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability in BigBlueButton allows an attacker to impersonate an active meeting participant by reusing their session. The issue occurs because the /bigbluebutton/api/handleJoinExistingUser endpoint was exposed as a public controller action instead of a private helper, enabling session reuse with a valid existingUserID.

Detection Guidance

To detect this vulnerability, check if your BigBlueButton instance is running version 3.0.23 or later. You can verify the version by running: curl -s http://your-bbb-server/bigbluebutton/api | grep -oP 'version=\K[0-9.]+' on your server. If the version is below 3.0.23, the system is vulnerable.

Impact Analysis

An attacker could join a meeting under a legitimate user's identity, gaining unauthorized access to private meeting content, chat messages, or other sensitive data shared during the session. This could lead to data breaches or unauthorized actions performed in the victim's name.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance violations and potential penalties.

Mitigation Strategies

Immediately upgrade BigBlueButton to version 3.0.23 or later to patch the vulnerability. After upgrading, restart the BigBlueButton services to ensure the changes take effect. Monitor meeting sessions for any unusual activity or impersonation attempts.

Hi! I’m here to help you understand CVE-2026-46355. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70