CVE-2025-61602

BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed `reactionEmojiId` in the GraphQL mutation `chatSendMessageReaction`. Version 3.0.13 contains a patch. No known workarounds are available.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/bigbluebutton/bigbluebutton/pull/23651	Issue Tracking Patch
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-45j2-m26c-3pcm	Exploit Vendor Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-45j2-m26c-3pcm	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) BigBlueButton es un aula virtual de código abierto. Una vulnerabilidad de denegación de servicio (DoS) en versiones anteriores a la 3.0.13 permite a cualquier usuario autenticado colapsar la funcionalidad de chat para todos los participantes en una reunión al enviar un 'reactionEmojiId' malformado en la mutación GraphQL 'chatSendMessageReaction'. La versión 3.0.13 contiene un parche. No se conocen soluciones alternativas disponibles.

Information

Published : 2025-10-09 21:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-61602

Mitre link : CVE-2025-61602

CVE.ORG link : CVE-2025-61602

JSON object : View

Products Affected

bigbluebutton

bigbluebutton

CWE

CWE-703

Improper Check or Handling of Exceptional Conditions

{"id": "CVE-2025-61602", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61602", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-10T14:30:47.957269Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "bigbluebutton", "product": "bigbluebutton", "versions": [{"status": "affected", "version": "< 3.0.13"}]}]}], "published": "2025-10-09T21:15:39.640", "references": [{"url": "https://github.com/bigbluebutton/bigbluebutton/pull/23651", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-45j2-m26c-3pcm", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-45j2-m26c-3pcm", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-703"}]}], "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed `reactionEmojiId` in the GraphQL mutation `chatSendMessageReaction`. Version 3.0.13 contains a patch. No known workarounds are available."}, {"lang": "es", "value": "BigBlueButton es un aula virtual de c\u00f3digo abierto. Una vulnerabilidad de denegaci\u00f3n de servicio (DoS) en versiones anteriores a la 3.0.13 permite a cualquier usuario autenticado colapsar la funcionalidad de chat para todos los participantes en una reuni\u00f3n al enviar un 'reactionEmojiId' malformado en la mutaci\u00f3n GraphQL 'chatSendMessageReaction'. La versi\u00f3n 3.0.13 contiene un parche. No se conocen soluciones alternativas disponibles."}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AF3725E-941E-4C75-AA27-20DC97552948", "versionEndExcluding": "3.0.13"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}