Vulnerability Description
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script content, and the script executed in another user's browser when that user replayed the recording. This issue is fixed in version 3.0.29.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/bigbluebutton/bigbluebutton/commit/a53f2b92022388bfa4109d3136
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.29
- https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-57p5-c88
FAQ
What is CVE-2026-55491?
CVE-2026-55491 is a vulnerability with a CVSS score of 5.4 (MEDIUM). BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshar...
How severe is CVE-2026-55491?
CVE-2026-55491 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55491?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.