CVE-2026-27737
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
BigBlueButton prior to version 3.0.19 does not sanitize user input in public chat during recording playback. This allows a malicious actor to carry out an XSS attack that activates on anyone replaying the recording. The issue has been fixed in version 3.0.19.
Risk Assessment
An attacker can inject malicious scripts that execute in the browsers of all users replaying the recording, potentially leading to data theft or session hijacking.
Recommendation
Update BigBlueButton to version 3.0.19 or later.
Original NVD description (English source)
BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording. This issue has been fixed 3.0.19.