CVE-2026-27736 — BigBlueButton has Open Redirect vulnerability in ApiController
BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly i…
Published: 2026-02-25 · CVSS: 6.1 · CVSS 3.1
BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No known workarounds are available.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7