Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2026-46404

BigBlueButton: Presentation URL Security Hardening

Description

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0.23.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

bigbluebutton bigbluebutton

  • < 3.0.23affected

References