VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Feb 25, 2026· Updated Jun 17, 2026

CVE-2026-27736

CVE-2026-27736

Description

BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No known workarounds are available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Bigbluebutton/Bigbluebutton3 versions
    cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*range: <3.0.20
    • (no CPE)range: <3.0.20
    • (no CPE)range: >= 3.0.0, < 3.0.20

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.