CVE-2025-61602: BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId
BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed reactionEmojiId in the GraphQL mutation chatSendMessageReaction. Version 3.0.13 contains a patch. No known workarounds are available.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61602?
CVE-2025-61602 is classified as a denial-of-service vulnerability, affecting the chat functionality in BigBlueButton.
How do I fix CVE-2025-61602?
To fix CVE-2025-61602, upgrade BigBlueButton to version 3.0.13 or later.
Who is affected by CVE-2025-61602?
Any user of BigBlueButton versions prior to 3.0.13 who is authenticated can potentially crash the chat functionality.
What happens if I don't address CVE-2025-61602?
If CVE-2025-61602 is not addressed, any authenticated user can disrupt meetings by crashing the chat for all participants.
When was CVE-2025-61602 reported?
CVE-2025-61602 was reported with specific vulnerabilities in versions of BigBlueButton prior to the 3.0.13 release.