VYPR
← All advisories
Low severity2.0NVD Advisory· Published Feb 21, 2026· Updated Jun 17, 2026

CVE-2026-27467

CVE-2026-27467

Description

BigBlueButton is an open-source virtual classroom. In versions 3.0.19 and below, when first joining a session with the microphone muted, the client sends audio to the server regardless of mute state. Media is discarded at the server side, so it isn't audible to any participants, but this may allow for malicious server operators to access audio data. The behavior is only incorrect between joining the meeting and the first time the user unmutes. This issue has been fixed in version 3.0.20.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Bigbluebutton/Bigbluebutton3 versions
    cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*range: <3.0.20
    • (no CPE)range: <=3.0.19
    • (no CPE)range: < 3.0.20

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.