CVE-2026-55491

Received Received - Intake

Stored XSS in BigBlueButton Record-and-Playback

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script content, and the script executed in another user's browser when that user replayed the recording. This issue is fixed in version 3.0.29.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-55491

Affected Vendors & Products

Vendor	Product	Version / Range
bigbluebutton	bigbluebutton	to 3.0.29 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

BigBlueButton before version 3.0.29 had a flaw where meeting names were not properly escaped in the screenshare playback feature. This allowed a low-privileged user to inject malicious script code into a meeting name. When another user replayed a recording containing this crafted name, the script would execute in their browser.

Detection Guidance

This vulnerability involves stored XSS in BigBlueButton meeting names. To detect it, check BigBlueButton server logs for unusual meeting names containing script tags or HTML entities. Review recordings for embedded scripts in playback names. No specific commands are provided in the context.

Impact Analysis

If you replay a recording with a malicious meeting name, the injected script could steal session cookies, perform actions on your behalf, or redirect you to phishing sites. It requires you to view a compromised recording but could lead to account compromise or data theft.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Organizations using BigBlueButton may face compliance violations if user data is exposed due to this flaw.

Mitigation Strategies

Upgrade BigBlueButton to version 3.0.29 or later immediately. If upgrading is not possible, restrict user permissions to prevent meeting name modifications and sanitize meeting names in playback templates.

Hi! I’m here to help you understand CVE-2026-55491. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70