The vulnerability arises in BigBlueButton 3.x before 3.0.20 where the errorRedirectUrl string supplied to the ApiController is used without validation in respondWithRedirect, enabling an attacker to specify an arbitrary URL. This leads to an open‑redirect flaw that can be abused to steer users to malicious sites, support phishing, or cloak malicious links, compromising the integrity of user interactions. The weakness corresponds to CWE‑601 – Open Redirect.

The flaw affects the open‑source virtual classroom software BigBlueButton. Versions on the 3.x branch older than 3.0.20 are vulnerable; the issue is fixed in BigBlueButton 3.0.20 and later. The vulnerability originates in the ApiController component that handles errorRedirectUrl parameters in HTTP requests.

The CVSS score is 6.1, indicating medium severity. The EPSS score is below 1 %, suggesting a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, open redirects facilitate phishing and other malicious campaigns, so an attacker may still target exposed BigBlueButton instances if the errorRedirectUrl input is not properly validated. The flaw can be exploited remotely via crafted HTTP requests against the API endpoint, with no privilege escalation required on the server.