CVE-2026-27736

—

CVSS 3.1

6.1 medium

EPSS

<1%p4

Published

Feb 25, 2026 (Feb 25, 2026)

Modified

Jun 17, 2026

Description

BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No known workarounds are available.

Vendors: bigbluebutton
Products: bigbluebutton
Weakness: CWE-601
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.1%)

In the news0 stories

No ingested article mentions this CVE yet.