PT-2026-60544 · Bigbluebutton · Bigbluebutton

CVE-2026-46404 · Published 2026-07-16 · Updated 2026-07-16

NVD

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0.23.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-46404

Affected Products

Bigbluebutton

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-46404 · Security Note
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h · Note
• https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27 · Note