CVE-2026-46355: BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting because handleJoinExistingUser was a routable controller action rather than a private helper. This issue is fixed in version 3.0.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BigBlueButtonto a version that resolves this vulnerability.Fixed in 3.0.23
Event History
Frequently Asked Questions
Which deployments are affected?
BigBlueButton versions prior to 3.0.23 are affected. The vulnerable endpoint was exposed by the bigbluebutton-web ApiController as a routable controller action.
What does an attacker need to exploit this issue?
The attacker needs an existingUserID belonging to an active participant. With that value, they can reuse the participant's session and impersonate them in the same meeting.
Does exploitation require an existing account or user interaction?
No existing attacker account or user interaction is indicated. The issue is described as an exposed endpoint that can be used by a requester able to provide an active participant's existingUserID.
What is the remediation?
Upgrade BigBlueButton to version 3.0.23, which fixes the exposed handleJoinExistingUser controller action.