CVE-2026-41126CWE-601

BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"

Medium · published April 21, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
19.6
In the wild
Unconfirmed
What it is

BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have an Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL." Version 3.0.24 has adjusted the handling of requests with incorrect checksum so that the default logoutURL is used. No known workarounds are available.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.6th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-04-21T23:22Z
EPSS history
Timeline
  • 21 APR 23:22Z
    BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"
    cvelistv5