CVE-2025-61601

BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's `Choices` response type. By submitting a malicious payload with a massive array in the `answerIds` field, the attacker can cause the current meeting — and potentially all meetings on the server — to become unresponsive. Version 3.0.13 contains a patch. No known workarounds are available.

• CWE-703

• https://github.com/bigbluebutton/bigbluebutton/pull/23662Issue Tracking, Patch
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5Exploit, Vendor Advisory
• https://www.youtube.com/watch?v=BwROSVIYjOYExploit
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5Exploit, Vendor Advisory
• https://www.youtube.com/watch?v=BwROSVIYjOYExploit

Published

Oct 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-61596Rejected reason: This is a fork and is not in the Rust regis…
• CVE-2025-61597Emlog is an open source website building system. In versions…5.4
• CVE-2025-61598Discourse is an open source discussion platform. Version bef…5.3
• CVE-2025-61599Emlog is an open source website building system. A stored Cr…5.4
• CVE-2025-6160A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-61600Stalwart is a mail and collaboration server. Versions 0.13.3…7.5
• CVE-2025-61602BigBlueButton is an open-source virtual classroom. A denial-…7.5
• CVE-2025-61603WeGIA is a Web manager for charitable institutions. Versions…9.8
• CVE-2025-61604WeGIA is an open source web manager with a focus on charitab…7.1
• CVE-2025-61605WeGIA is an open source web manager with a focus on charitab…9.8
• CVE-2025-61606WeGIA is an open source web manager with a focus on charitab…6.1
• CVE-2025-61607In nr modem, there is a possible system crash due to imprope…7.5