PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-27737 BigBlueButton CVE debrief

A stored cross-site scripting (XSS) vulnerability exists in BigBlueButton's recording playback feature (presentation format) prior to version 3.0.19. The public chat messages displayed during recording playback were not properly sanitized, allowing a malicious actor to inject and execute arbitrary JavaScript when any user replays an affected recording. The vulnerability requires low privileges to exploit (authenticated user able to post chat messages), has low attack complexity, and can be triggered without user interaction during playback. The confidentiality impact is none, but integrity impact is high as attackers can modify client-side behavior. No availability impact is indicated. The issue has been resolved in BigBlueButton 3.0.19. ScaleLite, a load balancer for BigBlueButton, also released version 1.7.0 which may incorporate related fixes.

Vendor
BigBlueButton
Product
BigBlueButton
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-18
Original CVE updated
2026-07-24
Advisory published
2026-05-18
Advisory updated
2026-07-24

Who should care

Organizations operating BigBlueButton virtual classroom instances, particularly those with public or semi-public access where recordings are shared. Educational institutions, corporate training departments, and webinar providers using BigBlueButton for recorded content distribution. Security teams responsible for web application security in e-learning platforms.

Technical summary

The vulnerability exists in the presentation format recording playback component of BigBlueButton. User-supplied input in public chat messages was rendered without adequate sanitization, enabling stored XSS. When any user subsequently replays the recording, the malicious script executes in their browser context. The attack vector is network-based, requires low privileges (authenticated user), and has no user interaction requirement during exploitation. The fix involves proper input sanitization in the playback rendering pipeline.

Defensive priority

medium

Recommended defensive actions

  • Upgrade BigBlueButton to version 3.0.19 or later to remediate the stored XSS vulnerability in recording playback
  • If using ScaleLite for BigBlueButton load balancing, upgrade to version 1.7.0 or later
  • Review existing recorded sessions for suspicious chat content that may contain injected scripts
  • Implement Content Security Policy (CSP) headers as defense-in-depth for playback interfaces
  • Audit access logs for unusual activity related to recording playback access patterns

Evidence notes

CVE published 2026-05-18; modified 2026-05-19. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. CWE-79 (Improper Neutralization of Input During Web Page Generation). Fix commits identified in bbb-playback and bigbluebutton repositories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-27737 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-27737

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-27737 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-27737

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.