PT-2026-21960 · Unknown · Bigbluebutton

Denizparlak · Published 2026-02-25 · Updated 2026-03-05 · CVE-2026-27736

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.20

Description BigBlueButton is a virtual classroom platform. Versions of the 3.x branch before 3.0.20 contain an Open Redirect issue. The errorRedirectUrl string is not properly validated, and is directly used in the respondWithRedirect function. This allows for redirection to a malicious URL.

Recommendations Update to version 3.0.20 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-27736

GHSA-65CV-RG9F-QQRX

Affected Products

Bigbluebutton

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27736.json · Exploit
• https://github.com/bigbluebutton/bigbluebutton/commit/691f92f3af0d6b796b91cb968977068663119812 · Patch
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27736 · Security Note
• https://twitter.com/infoflowcloud/status/2027100384871764207 · Twitter Post
• https://twitter.com/CVEnew/status/2027099318180790528 · Twitter Post
• https://t.me/cveNotify/154368 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026752850785632688 · Twitter Post