CVE-2026-41126

BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have an Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL." Version 3.0.24 has adjusted the handling of requests with incorrect checksum so that the default logoutURL is used. No known workarounds are available.

Score

CVSS 3.1 4.3 Medium

Status

Deferred - security-advisories@github.com

Published

2026-04-22

Last modified

2026-04-22

Weaknesses

CWE-601

Affected products

• Bigbluebutton (Bigbluebutton)

References

• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8