CVE-2026-55491: BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script content, and the script executed in another user's browser when that user replayed the recording. This issue is fixed in version 3.0.29.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BigBlueButtonto a version that resolves this vulnerability.Fixed in 3.0.29
Event History
Frequently Asked Questions
Who can exploit this issue, and when does the payload run?
A low-privileged user must be able to set a crafted meeting name. The stored script runs when another user replays a recording in the screenshare playback format.
Which deployments are affected?
BigBlueButton versions before 3.0.29 are affected. Version 3.0.29 contains the fix.
What can be done if an immediate upgrade is not possible?
The provided information does not identify a configuration workaround. Limit the ability of low-privileged users to create or control meeting names, and avoid replaying potentially untrusted screenshare recordings until the instance can be updated.