SB2026041454 - Multiple vulnerabilities in BigBlueButton

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Authorization bypass through user-controlled key (CVE-ID: N/A)

The vulnerability allows a remote user to modify captions.

The vulnerability exists due to improper access control in caption submission handling in bbb-apps-akka and bbb-graphql-actions when handling caption submission requests. A remote user can submit captions or overwrite existing ones to modify captions.

Viewers and non-audio users are able to perform the unauthorized caption changes.

2) Open redirect (CVE-ID: N/A)

The vulnerability allows a remote attacker to redirect a client to a malicious URL.

The vulnerability exists due to url redirection to an untrusted site in bigbluebutton/api/join when handling requests with the logoutURL get-parameter and an incorrect checksum. A remote attacker can supply a crafted logoutURL value to redirect a client to a malicious URL.

User interaction is required for the redirect to occur.

Remediation

Install update from vendor's website.

References

• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q387-2q28-mg33
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8