PatchSiren cyber security CVE debrief
CVE-2026-27737 BigBlueButton CVE debrief
A stored cross-site scripting (XSS) vulnerability exists in BigBlueButton's recording playback feature (presentation format) prior to version 3.0.19. The public chat messages displayed during recording playback were not properly sanitized, allowing a malicious actor to inject and execute arbitrary JavaScript when any user replays an affected recording. The vulnerability requires low privileges to exploit (authenticated user able to post chat messages), has low attack complexity, and can be triggered without user interaction during playback. The confidentiality impact is none, but integrity impact is high as attackers can modify client-side behavior. No availability impact is indicated. The issue has been resolved in BigBlueButton 3.0.19. ScaleLite, a load balancer for BigBlueButton, also released version 1.7.0 which may incorporate related fixes.
- Vendor
- BigBlueButton
- Product
- BigBlueButton
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-18
- Original CVE updated
- 2026-05-19
- Advisory published
- 2026-05-18
- Advisory updated
- 2026-05-19
Who should care
Organizations operating BigBlueButton virtual classroom instances, particularly those with public or semi-public access where recordings are shared. Educational institutions, corporate training departments, and webinar providers using BigBlueButton for recorded content distribution. Security teams responsible for web application security in e-learning platforms.
Technical summary
The vulnerability exists in the presentation format recording playback component of BigBlueButton. User-supplied input in public chat messages was rendered without adequate sanitization, enabling stored XSS. When any user subsequently replays the recording, the malicious script executes in their browser context. The attack vector is network-based, requires low privileges (authenticated user), and has no user interaction requirement during exploitation. The fix involves proper input sanitization in the playback rendering pipeline.
Defensive priority
medium
Recommended defensive actions
- Upgrade BigBlueButton to version 3.0.19 or later to remediate the stored XSS vulnerability in recording playback
- If using ScaleLite for BigBlueButton load balancing, upgrade to version 1.7.0 or later
- Review existing recorded sessions for suspicious chat content that may contain injected scripts
- Implement Content Security Policy (CSP) headers as defense-in-depth for playback interfaces
- Audit access logs for unusual activity related to recording playback access patterns
Evidence notes
CVE published 2026-05-18; modified 2026-05-19. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. CWE-79 (Improper Neutralization of Input During Web Page Generation). Fix commits identified in bbb-playback and bigbluebutton repositories.
Official resources
2026-05-18