Description

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting because handleJoinExistingUser was a routable controller action rather than a private helper. This issue is fixed in version 3.0.23.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T22:17:19.193Z",
  "pubdate": "2026-08-20T22:17:19.193Z",
  "executiveSummary": "An improper access control vulnerability exists in BigBlueButton prior to version 3.0.23, specifically within the API controller handling logic. The flaw allows an unauthenticated or arbitrarily positioned requester capable of supplying a valid existingUserID for an active participant to hijack that participant's session.\nThe vulnerability affects BigBlueButton virtual classroom deployments running vulnerable versions by exposing a sensitive internal helper function as a directly routable controller action.\nThe business and operational impact includes complete session impersonation within an ongoing meeting, allowing unauthorized actors to masquerade as legitimate participants, potentially compromising meeting integrity, confidentiality, and participant safety.\nAttacker capabilities require the ability to interact with the web application and knowledge or derivation of an active participant's existingUserID. No advanced cryptographic bypass is required due to the direct exposure of the endpoint.\nRisk implications are high for environments hosting sensitive virtual classrooms where meeting confidentiality and non-repudiation of participant identity are critical security requirements.",
  "technicalDetails": "The root cause of the vulnerability stems from incorrect access restriction and routing configuration within the Grails web application framework. Specifically, the method handleJoinExistingUser located in bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy was incorrectly exposed as a publicly routable controller action rather than functioning as a private helper method restricted to internal application workflows.\nThe vulnerable component is the API controller layer of BigBlueButton, which manages meeting join operations and session lifecycles. Affected versions include all BigBlueButton deployments prior to version 3.0.23.\nThe attack flow proceeds as follows: First, an attacker identifies an active virtual classroom meeting and discovers or guesses the existingUserID associated with an active participant. Second, the attacker constructs an HTTP request targeting the exposed /bigbluebutton/api/handleJoinExistingUser endpoint, supplying the harvested existingUserID parameter. Third, because the application fails to validate the authorization or session context of the requester against the targeted user ID, the controller processes the request and maps the requester to the active participant's session.\nAuthentication and privilege requirements for exploitation are minimal; the requester needs network access to the BigBlueButton web application interface and a valid existingUserID corresponding to a victim currently engaged in a meeting. The network exposure is tied directly to the web service port exposing the BigBlueButton API routes.\nThe resulting payload behavior forces the server-side application state to reuse the existing participant session, effectively cloning or transferring the session context to the attacker. Post-exploitation impact enables the unauthorized actor to fully impersonate the legitimate participant, granting them the ability to view, hear, interact, or disrupt the virtual classroom session under the guise of the victim."
}