CVE-2026-41126

BigBlueButton (open-source virtual classroom) vulnerable in versions prior to 3.0.24 to an Open Redirect via the join endpoint (bigbluebutton/api/join) using the logoutURL GET parameter. The root cause is the handling of requests with an incorrect checksum, after which the default logoutURL is us...