PT-2026-41738 · Unknown · Bigbluebutton

Published 2026-05-18 · Updated 2026-05-19 · CVE-2026-27737

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.19

Description Recording playback in presentation format fails to sanitize user input within the public chat. This allows a malicious actor to execute a targeted Cross-Site Scripting (XSS) attack—a technique where malicious scripts are injected into trusted websites—which is triggered for any user replaying the recording.

Recommendations Update to version 3.0.19.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27737

Affected Products

Bigbluebutton

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-27737 · Security Note
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.19 · Note
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8vv7-vj94-q2pv · Note
• https://github.com/bigbluebutton/bigbluebutton/commit/69f45aa1b963dc7d80179d0155acc670aec5c4fc · Note
• https://github.com/blindsidenetworks/scalelite/releases/tag/v1.7.0 · Note
• https://github.com/bigbluebutton/bbb-playback/commit/09e89bfe4ff8488b68c3ff040d3081e419dc89b1 · Note
• https://twitter.com/VulmonFeeds/status/2056525205435031575 · Twitter Post
• https://t.me/cveNotify/163935 · Telegram Post
• https://twitter.com/CVEnew/status/2056670121826115750 · Twitter Post
• https://twitter.com/infoflowcloud/status/2056671542239494268 · Twitter Post
• https://t.me/CVEtracker/54175 · Telegram Post