Prior to the release of BigBlueButton v3.0.21, the bbb-web component generated sessionToken values using an insecure random generator in bbb-common-web/src/main/java/org/bigbluebutton/api/Util.java and bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. The insufficient randomness made the tokens predictable, allowing an attacker to guess or brute‑force a token and join a conference as another user, thus compromising confidentiality and integrity of the virtual classroom environment.

All BigBlueButton installations using versions 3.0.0 through 3.0.20 are affected. The flaw resides in the bbb‑web and bbb‑common‑web components that generate the tokens.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1 % suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by guessing or brute‑forcing session tokens that appear in conference join URLs or API calls. No additional privileges are required beyond network access to the exposed web interface. The likely attack vector is the web interface that generates tokens (inferred from the code location).