PT-2026-21365 · Unknown · Bigbluebutton

Jörg Schwenk + 3 · Published 2026-02-21 · Updated 2026-02-21 · CVE-2026-27467

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions 3.0.19 and below

Description BigBlueButton is a virtual classroom platform. When a user joins a session with the microphone initially muted, the client may send audio data to the server despite the mute state. While the server discards this audio, preventing it from being audible to other participants, a malicious server operator could potentially access this data. This behavior occurs only between joining the meeting and the first time the user unmutes.

Recommendations Update to version 3.0.20 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-27467

GHSA-6GJ9-5RHM-68J8

Affected Products

Bigbluebutton

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27467.json · Exploit
• https://github.com/bigbluebutton/bigbluebutton/commit/3aa47832bc2b17178799bd932453c226e8f95703 · Patch
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-6gj9-5rhm-68j8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27467 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27467 · Vendor Advisory
• https://t.me/CVEtracker/45364 · Telegram Post
• https://t.me/cveNotify/152708 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2025193416515076180 · Twitter Post
• https://twitter.com/CVEnew/status/2025154174913011996 · Twitter Post