CVE-2026-46355

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting because handleJoinExistingUser was a routable controller action rather than a private helper. This issue is fixed in version 3.0.23.

• CWE-287

• https://github.com/bigbluebutton/bigbluebutton/commit/972b04e474e195cbd708b5b3f0485fe528a1a85b
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.23
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr

Published

Aug 20, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46349Mastodon is a free, open-source social network server based …5.3
• CVE-2026-4635Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4…5.3
• CVE-2026-46351BigBlueButton is an open-source virtual classroom. Prior to …8.1
• CVE-2026-46352Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-46353BigBlueButton is an open-source virtual classroom. Prior to …8.1
• CVE-2026-46354Coder allows organizations to provision remote development e…9.1
• CVE-2026-46356Fleet is open source device management software. Prior to ve…7.5
• CVE-2026-46357HAX CMS helps manage microsite universe with PHP or NodeJs b…6.5
• CVE-2026-46358OpenBao is an open source identity-based secrets management …5.4
• CVE-2026-46359phpMyFAQ before 4.1.2 contains a sql injection vulnerability…7.7
• CVE-2026-4636A flaw was found in Keycloak. An authenticated user with the…8.1
• CVE-2026-46360phpMyFAQ before 4.1.2 contains a stored cross-site scripting…5.4