CVE-2022-41960

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to `validateAuthToken` using a victim's userId, meetingId, and an invalid authToken. This forces the victim to leave the conference, because the resulting verification failure is also observed and handled by the victim's client. The attacker must be a participant in any meeting on the server. This issue is patched in version 2.4.3. There are no workarounds.

• CWE-345

• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.3Release Notes, Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1Release Notes, Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rgjp-3r74-g4cmRelease Notes, Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.3Release Notes, Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1Release Notes, Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rgjp-3r74-g4cmRelease Notes, Third Party Advisory

Published

Dec 16, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41954MPXJ is an open source library to read and write project pla…3.3
• CVE-2022-41955Autolab is a course management service, initially developed …8.8
• CVE-2022-41956Autolab is a course management service, initially developed …6.5
• CVE-2022-41957Muhammara is a node module with c/cpp bindings to modify PDF…7.5
• CVE-2022-41958super-xray is a web vulnerability scanning tool. Versions pr…7.8
• CVE-2022-4196The Multi Step Form WordPress plugin before 1.7.8 does not s…4.8
• CVE-2022-41961BigBlueButton is an open source web conferencing system. Ver…4.3
• CVE-2022-41962BigBlueButton is an open source web conferencing system. Ver…2.7
• CVE-2022-41963BigBlueButton is an open source web conferencing system. Ver…3.1
• CVE-2022-41964BigBlueButton is an open source web conferencing system. Thi…5.7
• CVE-2022-41965Opencast is a free, open-source platform to support the mana…6.1
• CVE-2022-41966XStream serializes Java objects to XML and back again. Versi…7.5