SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-46353

HIGH · CVSS 8.1 EPSS 0.27% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-16 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The vulnerability in BigBlueButton affects the checksum validation process in the bbb-web component, allowing attackers to bypass security measures when uploading presentations via the CreateMeeting API. This could lead to unauthorized access or manipulation of meeting content, posing a significant risk to the integrity of virtual classroom sessions. Organizations using versions prior to 3.0.21 should prioritize updating to the latest version to mitigate this high-severity risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-46353
Severity
HIGH
CVSS
8.1
EPSS
0.27%
Java

Original NVD Description

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some endpoints without a checksum. This issue is fixed in version 3.0.21.