CVE-2026-27736

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27736
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27736.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27736
Aliases
  • GHSA-65cv-rg9f-qqrx
Published
2026-02-25T16:27:01.507Z
Modified
2026-08-05T03:32:28.069463523Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
BigBlueButton has Open Redirect vulnerability in ApiController
Details

BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No known workarounds are available.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27736.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "fixed": "3.0.20"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-601"
    ]
}
References

Affected packages

Git / github.com/bigbluebutton/bigbluebutton

Affected ranges

Type
GIT
Repo
https://github.com/bigbluebutton/bigbluebutton
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
691f92f3af0d6b796b91cb968977068663119812
Database specific 
{
    "source": "REFERENCES"
}

Affected versions

2.*
2.2-beta-10
2.2-beta-11
2.2-beta-12
2.2-beta-14
2.2-beta-15
2.2-beta-16
2.2-beta-17
2.2-beta-18
2.2-beta-19
2.2-beta-2
2.2-beta-20
2.2-beta-21
2.2-beta-22
2.2-beta-23
2.2-beta-3
2.2-beta-4
2.2-beta-5
2.2-beta-6
2.2-beta-7
2.2-beta-8
2.2-beta-9
2.2-rc-1
2.2-rc-2
2.2-rc-3
3.*
3.0.0-rc.1
Other
dcs-2-a
v0.*
v0.8
v0.8b4
v0.8b4.0
v0.8rc2
v0.9.0-beta
v2.*
v2.3-alpha-1
v2.3-alpha-2
v2.3-alpha-3
v2.3-alpha-4
v2.3-alpha-5
v2.3-alpha-6
v2.3-alpha-7
v2.3-alpha-8
v2.3-beta-1
v2.3-beta-2
v2.3-beta-3
v2.3-beta-4
v2.3-beta-5
v2.3-rc-1
v2.3-rc-2
v2.3.0
v2.3.1
v2.4-alpha-1
v2.4-beta-1
v2.4-beta-2
v2.4-beta-3
v2.4-beta-4
v3.*
v3.0.0
v3.0.0-alpha.1
v3.0.0-alpha.2
v3.0.0-alpha.3
v3.0.0-alpha.4
v3.0.0-alpha.6
v3.0.0-alpha.7
v3.0.0-beta.1
v3.0.0-beta.2
v3.0.0-beta.3
v3.0.0-beta.4
v3.0.0-beta.5
v3.0.0-beta.6
v3.0.0-beta.7
v3.0.0-rc.1
v3.0.0-rc.2
v3.0.0-rc.3
v3.0.0-rc.4
v3.0.1
v3.0.10
v3.0.11
v3.0.12
v3.0.13
v3.0.14
v3.0.15
v3.0.16
v3.0.17
v3.0.18
v3.0.19
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.7
v3.0.8
v3.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27736.json"