CVE Explorer

CVE-2026-46351

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web generated conference sessionToken values with insufficiently secure randomness in bbb-common-web/src/main/java/org/bigbluebutton/api/Util.java and bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy, allowing a session user to predict other users' conference session tokens and impersonate them. This issue is fixed in version 3.0.21.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:6d9e13d2cda692c9c86fa6a2ad762d6558c528e09de236cd62e6f0efd77dc60f

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"bigbluebutton","vendor":"bigbluebutton","versions":[{"status":"affected","version":"< 3.0.21"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:90a8bba018fa6abf2447465a7e472b06694ad670d112441b610534ff57ebf02f · sha256:b6cb510f989f84d6… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:90a8bba018fa6abf2447465a7e472b06694ad670d112441b610534ff57ebf02f · sha256:b6cb510f989f84d6… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-330","description":"CWE-330: Use of Insufficiently Random Values","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:90a8bba018fa6abf2447465a7e472b06694ad670d112441b610534ff57ebf02f · sha256:b6cb510f989f84d6… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions

{"name":"https://github.com/bigbluebutton/bigbluebutton/commit/8457886c248aeba5597ee8749267602d6d117e98","tags":["x_refsource_MISC"],"url":"https://github.com/bigbluebutton/bigbluebutton/commit/8457886c248aeba5597ee8749267602d6d117e98"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:90a8bba018fa6abf2447465a7e472b06694ad670d112441b610534ff57ebf02f · sha256:b6cb510f989f84d6… · /containers/cna/references/1

{"name":"https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.21","tags":["x_refsource_MISC"],"url":"https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.21"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:90a8bba018fa6abf2447465a7e472b06694ad670d112441b610534ff57ebf02f · sha256:b6cb510f989f84d6… · /containers/cna/references/2

{"name":"https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-7959-pf2v-xc4h","tags":["x_refsource_CONFIRM"],"url":"https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-7959-pf2v-xc4h"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:90a8bba018fa6abf2447465a7e472b06694ad670d112441b610534ff57ebf02f · sha256:b6cb510f989f84d6… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer