CVE-2026-46355

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46355", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T18:37:30.991Z", "datePublished": "2026-08-20T21:34:40.529Z", "dateUpdated": "2026-08-25T15:26:14.221Z"}, "containers": {"cna": {"title": "BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr"}, {"name": "https://github.com/bigbluebutton/bigbluebutton/commit/972b04e474e195cbd708b5b3f0485fe528a1a85b", "tags": ["x_refsource_MISC"], "url": "https://github.com/bigbluebutton/bigbluebutton/commit/972b04e474e195cbd708b5b3f0485fe528a1a85b"}, {"name": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23", "tags": ["x_refsource_MISC"], "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23"}], "affected": [{"vendor": "bigbluebutton", "product": "bigbluebutton", "versions": [{"version": "< 3.0.23", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:34:40.529Z"}, "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting because handleJoinExistingUser was a routable controller action rather than a private helper. This issue is fixed in version 3.0.23."}], "source": {"advisory": "GHSA-38fw-2gq7-ccgr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T15:26:02.501669Z", "id": "CVE-2026-46355", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T15:26:14.221Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46355", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T15:26:02.501669Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T15:26:08.767Z"}}], "cna": {"title": "BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser", "source": {"advisory": "GHSA-38fw-2gq7-ccgr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "bigbluebutton", "product": "bigbluebutton", "versions": [{"status": "affected", "version": "< 3.0.23"}]}], "references": [{"url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr", "name": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/bigbluebutton/bigbluebutton/commit/972b04e474e195cbd708b5b3f0485fe528a1a85b", "name": "https://github.com/bigbluebutton/bigbluebutton/commit/972b04e474e195cbd708b5b3f0485fe528a1a85b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23", "name": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting because handleJoinExistingUser was a routable controller action rather than a private helper. This issue is fixed in version 3.0.23."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T21:34:40.529Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46355", "state": "PUBLISHED", "dateUpdated": "2026-08-25T15:26:14.221Z", "dateReserved": "2026-05-13T18:37:30.991Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T21:34:40.529Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "bigbluebutton", "vendor": "bigbluebutton", "versions": [{"status": "affected", "version": "< 3.0.23"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting because handleJoinExistingUser was a routable controller action rather than a private helper. This issue is fixed in version 3.0.23."}, {"lang": "es", "value": "BigBlueButton es un aula virtual de c\u00f3digo abierto. Antes de la 3.0.23, BigBlueButton expon\u00eda /bigbluebutton/API/handleJoinExistingUser a trav\u00e9s de bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. Un solicitante que pudiera proporcionar un existingUserID para un participante activo podr\u00eda reutilizar la sesi\u00f3n de ese participante y suplantar su identidad en la misma reuni\u00f3n porque handleJoinExistingUser era una acci\u00f3n de controlador enrutable en lugar de una funci\u00f3n auxiliar privada. Este problema se ha solucionado en la versi\u00f3n 3.0.23."}], "id": "CVE-2026-46355", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46355", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T15:26:02.501669Z", "version": "2.0.3"}}]}, "published": "2026-08-20T22:17:19.193", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/bigbluebutton/bigbluebutton/commit/972b04e474e195cbd708b5b3f0485fe528a1a85b"}, {"source": "security-advisories@github.com", "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23"}, {"source": "security-advisories@github.com", "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.0.23)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "bigbluebutton", "source": "cna", "vendor": "bigbluebutton"}, "product": "bigbluebutton", "vendor": "bigbluebutton"}], "created": "2026-08-20T23:00:06.748839+00:00", "updated": "2026-08-21T01:00:04.534808+00:00", "vendors": ["bigbluebutton", "bigbluebutton$PRODUCT$bigbluebutton"]}