Unrated severityNVD Advisory· Published Jul 16, 2026· Updated Jul 17, 2026
BigBlueButton: Presentation URL Security Hardening
CVE-2026-46404
Description
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0.23.
Affected products
1- Range: <3.0.23
Patches
Vulnerability mechanics
References
2- github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27mitrex_refsource_MISC
- github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5hmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.