CVE-2026-27737: Bigbluebutton Bbb-Playback

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording. This issue has been fixed 3.0.19.

Affected products

• Bigbluebutton Bbb-Playback: before 5.4.3 (fixed in 5.4.3)
• Bigbluebutton Bigbluebutton: before 3.0.19 (fixed in 3.0.19)
• Blindsidenetworks Scalite: before 1.7.0 (fixed in 1.7.0)

Published 2026-05-18. Last modified 2026-07-24.