CVE-2026-46351: BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate them
BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values with insufficiently secure randomness in bbb-common-web/src/main/java/org/bigbluebutton/api/Util.java and bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy, allowing a session user to predict other users' conference session tokens and impersonate them. This issue is fixed in version 3.0.21.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BigBlueButtonto a version that resolves this vulnerability.Fixed in 3.0.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46351?
The severity of CVE-2026-46351 is rated as high with a score of 8.1.
What is CVE-2026-46351 about?
CVE-2026-46351 relates to BigBlueButton's generation of conference session tokens with insufficiently secure randomness, allowing potential impersonation.
How do I fix CVE-2026-46351?
To fix CVE-2026-46351, upgrade to BigBlueButton version 3.0.21 or later.
Can CVE-2026-46351 affect user confidentiality?
Yes, CVE-2026-46351 can compromise user confidentiality by allowing unauthorized impersonation through predictable session tokens.
What systems are impacted by CVE-2026-46351?
CVE-2026-46351 impacts BigBlueButton versions prior to 3.0.21.