CVE-2026-27467: BigBlueButton: Audio from participants to the server initially unmuted
BigBlueButton is an open-source virtual classroom. In versions 3.0.19 and below, when first joining a session with the microphone muted, the client sends audio to the server regardless of mute state. Media is discarded at the server side, so it isn't audible to any participants, but this may allow for malicious server operators to access audio data. The behavior is only incorrect between joining the meeting and the first time the user unmutes. This issue has been fixed in version 3.0.20.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27467?
CVE-2026-27467 has been rated as a medium severity vulnerability due to the potential for unintended audio transmission.
How do I fix CVE-2026-27467?
To fix CVE-2026-27467, upgrade BigBlueButton to version 3.0.20 or later immediately.
What versions of BigBlueButton are affected by CVE-2026-27467?
CVE-2026-27467 affects BigBlueButton versions 3.0.19 and below.
What impact does CVE-2026-27467 have on user privacy?
CVE-2026-27467 may lead to privacy breaches as it allows audio to be transmitted to the server even when participants are muted.
Is there a risk of data leakage due to CVE-2026-27467?
Yes, CVE-2026-27467 poses a risk of data leakage as participants' audio can be unintentionally sent to the server.