CVE-2026-27737

BigBlueButton has Stored XSS in bbb-playback replay

6.5 Medium

CVE-2026-27737 is a medium vulnerability (CVSS 6.5) in Bigbluebutton Bbb-playback, published May 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. No source names a fixed version.

BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording. This issue has been fixed 3.0.19.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.26%Up 0.2 points since May 19, 2026

What each source reports

CVE List Score used 6.5

BigBlueButton has Stored XSS in bbb-playback replay

Record: CVE-2026-27737
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2026-30811 6.5

Record: EUVD-2026-30811
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

NVD 6.5

Record: CVE-2026-27737
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.5