CVE-2020-26163 is a high-severity vulnerability affecting BigBlueButton Greenlight versions prior to 2.5.6, enabling HTTP header attacks via the Host and Origin headers. This flaw can lead to Account Takeover if a user clicks a spoofed password-reset link. The attack is network-based, low complexity, and requires user interaction, but can result in high impact to confidentiality, integrity, and availability. While no public exploits or active exploitation have been observed, and community discussion is minimal, the potential for a complete account compromise warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.5.6CPE matchmatch criteria | cpe:2.3:a:bigbluebutton:greenlight:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.