CVE-2026-41126

4.3 mediumEPSS 0.2%

Medium (4.3). EPSS 0.2% chance of exploitation in the next 30 days.

BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have an Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL." Version 3.0.24 has adjusted the handling of requests with incorrect checksum so that the default logoutURL is used. No known workarounds are available.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE: CWE-601
Published: 2026-04-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8

Check your stack JSON