01 Record

CVE-2026-46355

BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser

HighPUBLISHEDCNA: GitHub_M

Base score7.1 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

02 Description

BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser

Published

2026-08-20 21:34Z1 DAY AGO

Last updated

2026-08-20 21:34Z1 DAY AGO

Reserved

2026-05-13

Assigning CNA

GitHub_M

Record state

PUBLISHED

Severity

High (CVSS 7.1)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weaknesses

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

f27f599be1f93dcea1e2635834ec85106aaac5e82b67cf97eea65bd7a9b256a8

VendorProductVersionsPlatforms

bigbluebuttonbigbluebutton< 3.0.23—