PT-2026-21960 · Unknown · Bigbluebutton

Denizparlak · Publicado 2026-02-25 · Atualizado 2026-03-05 · CVE-2026-27736

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.20

Description BigBlueButton is a virtual classroom platform. Versions of the 3.x branch before 3.0.20 contain an Open Redirect issue. The errorRedirectUrl string is not properly validated, and is directly used in the respondWithRedirect function. This allows for redirection to a malicious URL.

Recommendations Update to version 3.0.20 or later.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-27736

GHSA-65CV-RG9F-QQRX

Produtos afetados

Bigbluebutton

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27736.json · Exploit
• https://github.com/bigbluebutton/bigbluebutton/commit/691f92f3af0d6b796b91cb968977068663119812 · Correção
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2027100384871764207 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2027099318180790528 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-27736 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27736 · Nota de Segurança
• https://t.me/cveNotify/154368 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2026752850785632688 · Publicação no Twitter