CVE-2026-27736: BigBlueButton has Open Redirect vulnerability in ApiController
BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No known workarounds are available.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27736?
CVE-2026-27736 is considered a moderate severity Open Redirect vulnerability affecting certain versions of BigBlueButton.
How do I fix CVE-2026-27736?
To fix CVE-2026-27736, upgrade your BigBlueButton installation to version 3.0.20 or later.
What impact does CVE-2026-27736 have on users?
CVE-2026-27736 could potentially allow an attacker to redirect users to malicious websites, compromising user security.
Which versions of BigBlueButton are affected by CVE-2026-27736?
CVE-2026-27736 affects BigBlueButton versions in the 3.x branch prior to 3.0.20.
Is there a workaround for CVE-2026-27736 if I can't immediately upgrade?
There are no recommended workarounds for CVE-2026-27736; upgrading to a patched version is the best mitigation.