CVE-2026-41126: URL Redirection to Untrusted Site

BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have an Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL." Version 3.0.24 has adjusted the handling of requests with incorrect checksum so that the default logoutURL is used. No known workarounds...

PT-2020-16714

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.3 Description The issue is related to the lack of LibreOffice sandboxing, which could allow remote authenticated users to read the API shared secret in the bigbluebutton.properties file. With access to the API...