CVE-2026-46404 BigBlueButton: Presentation URL Security Hardening
Attackers can exploit insufficient URL validation to access internal network resources via Server-Side Request Forgery in BigBlueButton.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-46404?
CVE-2026-46404 is a medium-severity server-side request forgery vulnerability in bigbluebutton, published on 16 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0.23.
Weakness: CWE-918
Which versions are affected by CVE-2026-46404?
How do I fix CVE-2026-46404?
No fix has been published for CVE-2026-46404 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-46404 being exploited?
There is no known exploitation of CVE-2026-46404 in the wild and no public exploit code.
Sources
Also known as GHSA-xqm3-6q7q-4v5h.