CVE-2026-27736

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27736", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-23T18:37:14.790Z", "datePublished": "2026-02-25T16:27:01.507Z", "dateUpdated": "2026-02-26T21:33:41.504Z"}, "containers": {"cna": {"title": "BigBlueButton has Open Redirect vulnerability in ApiController", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx"}, {"name": "https://github.com/bigbluebutton/bigbluebutton/commit/691f92f3af0d6b796b91cb968977068663119812", "tags": ["x_refsource_MISC"], "url": "https://github.com/bigbluebutton/bigbluebutton/commit/691f92f3af0d6b796b91cb968977068663119812"}], "affected": [{"vendor": "bigbluebutton", "product": "bigbluebutton", "versions": [{"version": ">= 3.0.0, < 3.0.20", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T16:27:01.507Z"}, "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No known workarounds are available."}], "source": {"advisory": "GHSA-65cv-rg9f-qqrx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27736", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T21:07:12.375891Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T21:33:41.504Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27736", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-23T18:37:14.790Z", "datePublished": "2026-02-25T16:27:01.507Z", "dateUpdated": "2026-02-26T21:33:41.504Z"}, "containers": {"cna": {"title": "BigBlueButton has Open Redirect vulnerability in ApiController", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx"}, {"name": "https://github.com/bigbluebutton/bigbluebutton/commit/691f92f3af0d6b796b91cb968977068663119812", "tags": ["x_refsource_MISC"], "url": "https://github.com/bigbluebutton/bigbluebutton/commit/691f92f3af0d6b796b91cb968977068663119812"}], "affected": [{"vendor": "bigbluebutton", "product": "bigbluebutton", "versions": [{"version": ">= 3.0.0, < 3.0.20", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T16:27:01.507Z"}, "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No known workarounds are available."}], "source": {"advisory": "GHSA-65cv-rg9f-qqrx", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27736", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T21:07:12.375891Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T21:07:14.460Z"}}]}}

{"affected": [{"affectedData": [{"product": "bigbluebutton", "vendor": "bigbluebutton", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.0.20"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC6C16D8-2543-43E9-8F1B-632501E23028", "versionEndExcluding": "3.0.20", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No known workarounds are available."}, {"lang": "es", "value": "BigBlueButton es un aula virtual de c\u00f3digo abierto. En versiones de la rama 3.x anteriores a la 3.0.20, la cadena recibida con errorRedirectUrl carece de validaci\u00f3n, usarla directamente en la funci\u00f3n respondWithRedirect conduce a una vulnerabilidad de redirecci\u00f3n abierta. BigBlueButton 3.0.20 corrige el problema. No se conocen soluciones alternativas disponibles."}], "id": "CVE-2026-27736", "lastModified": "2026-06-17T10:27:34.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27736", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T21:07:12.375891Z", "version": "2.0.3"}}]}, "published": "2026-02-25T17:25:40.283", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/bigbluebutton/bigbluebutton/commit/691f92f3af0d6b796b91cb968977068663119812"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.0.20)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "bigbluebutton", "source": "cna", "vendor": "bigbluebutton"}, "product": "bigbluebutton", "vendor": "bigbluebutton"}], "analysis": {"en": {"generated_at": "2026-04-17T15:05:31.298738+00:00", "value": {"mitigation_remediation": ["Upgrade to BigBlueButton version\u202f3.0.20 or newer to apply the vendor\u2011supplied fix.", "If an immediate upgrade is not possible, configure the web gateway or reverse proxy to reject or block requests that contain an errorRedirectUrl parameter, or redirect all redirects to a whitelist of trusted domains.", "Continuously monitor application logs for unexpected redirect attempts and traffic patterns indicative of phishing or malicious redirects."], "summary": {"action": "Immediate Patch", "impact": "Open Redirect"}, "threat_synthesis": {"affected_systems": "The flaw affects the open\u2011source virtual classroom software BigBlueButton. Versions on the 3.x branch older than 3.0.20 are vulnerable; the issue is fixed in BigBlueButton 3.0.20 and later. The vulnerability originates in the ApiController component that handles errorRedirectUrl parameters in HTTP requests.", "description_and_impact": "The vulnerability arises in BigBlueButton 3.x before 3.0.20 where the errorRedirectUrl string supplied to the ApiController is used without validation in respondWithRedirect, enabling an attacker to specify an arbitrary URL. This leads to an open\u2011redirect flaw that can be abused to steer users to malicious sites, support phishing, or cloak malicious links, compromising the integrity of user interactions. The weakness corresponds to CWE\u2011601 \u2013 Open Redirect.", "risk_and_exploitability": "The CVSS score is 6.1, indicating medium severity. The EPSS score is below 1\u202f%, suggesting a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, open redirects facilitate phishing and other malicious campaigns, so an attacker may still target exposed BigBlueButton instances if the errorRedirectUrl input is not properly validated. The flaw can be exploited remotely via crafted HTTP requests against the API endpoint, with no privilege escalation required on the server."}}}}, "created": "2026-02-26T13:15:21.609397+00:00", "updated": "2026-04-17T15:15:21.826596+00:00", "vendors": ["bigbluebutton", "bigbluebutton$PRODUCT$bigbluebutton"]}