CVE-2026-27736
BigBlueButton has Open Redirect vulnerability in ApiController
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 6.1EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
25 feb 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No known workarounds are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
bigbluebutton · bigbluebutton¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →