SB2026041454 - Multiple vulnerabilities in BigBlueButton

Description

This security bulletin contains information about 2 vulnerabilities.

1) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to modify captions.

The vulnerability exists due to improper access control in caption submission handling in bbb-apps-akka and bbb-graphql-actions when handling caption submission requests. A remote user can submit captions or overwrite existing ones to modify captions.

Viewers and non-audio users are able to perform the unauthorized caption changes.

2) Open redirect (CVE-ID: N/A)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to redirect a client to a malicious URL.

The vulnerability exists due to url redirection to an untrusted site in bigbluebutton/api/join when handling requests with the logoutURL get-parameter and an incorrect checksum. A remote attacker can supply a crafted logoutURL value to redirect a client to a malicious URL.

User interaction is required for the redirect to occur.

Remediation

Install update from vendor's website.

References

• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q387-2q28-mg33
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8