CVE-2026-27736CWE-601

BigBlueButton has Open Redirect vulnerability in ApiController

Medium · published February 25, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No known workarounds are available.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00264 · 17.4th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-02-25T16:27Z
EPSS history
Timeline
  • 25 FEB 16:27Z
    BigBlueButton has Open Redirect vulnerability in ApiController
    cvelistv5