CVE-2020-27613: Bigbluebutton

High severity, CVSS 8.4. EPSS: 0.3% chance of exploitation in the next 30 days.

The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended FreeSWITCH access.

Affected products

• Bigbluebutton Bigbluebutton: before 2.2.28 (fixed in 2.2.28)

Published 2020-10-21. Last modified 2026-06-17.