BigBlueButton versions before 3.0.24 allow an attacker to supply a malicious logoutURL through the bigbluebutton/api/join endpoint. The application trusts and redirects the user to the supplied URL, creating an Open Redirect (CWE‑601). While not a direct code execution flaw, the redirect can be used in phishing or credential‑harvest campaigns to lure users to malicious sites after they leave a meeting.

The vulnerability affects the BigBlueButton virtual classroom platform. All deployments running BigBlueButton prior to version 3.0.24 are susceptible. No specific sub‑product or component beyond the primary server is mentioned.

The CVSS score is 4.3, indicating medium severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. It is a client‑side vulnerability that requires a user to be tricked into following a redirect, making it less likely to be exploited automatically but still dangerous for phishing campaigns.