CVE-2026-27736

MEDIUM

BigBlueButton 3.x <3.0.20 - Open Redirect

Title source: llm

Description

BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No known workarounds are available.

References (2)

[Patch] https://github.com/bigbluebutton/bigbluebutton/commit/691f92f3af0d6b796b91cb968977068663119812

View Patch ZIP pw:eip

[Vendor Advisory] https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx

Scores

CVSS v3 6.1

EPSS 0.0003

EPSS Percentile 8.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-601

Status published

Affected Products (1)

bigbluebutton/bigbluebutton < 3.0.20

Timeline

Published Feb 25, 2026

Tracked Since Feb 26, 2026