CVE-2026-46353 — BigBlueButton API checksum bypass via presentationUploadExternalUrl
BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to …
Published: 2026-07-16 · CVSS: 8.1 · CVSS 3.1
BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some endpoints without a checksum. This issue is fixed in version 3.0.21.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7