This vulnerability exposes an HTTP API endpoint that allows any client to specify an existing participant's ID and join the meeting using that participant's session. By reusing the authenticated session token of an active user, an attacker can impersonate the participant, gaining the same level of access within the virtual classroom. The impact is the ability to observe, record, or interfere with the participant's activities without the host’s consent.

The affected product is BigBlueButton (vendor bigbluebutton). All versions prior to 3.0.23 contain an exposed /bigbluebutton/api/handleJoinExistingUser controller action. The issue is fixed in release 3.0.23 and later.

The vulnerability is rated 7.1 on the CVSS scale, indicating a moderate to high severity. Exploitation requires only an unauthenticated HTTP request to the exposed endpoint, so it is trivial for an attacker with network access to the API. The EPSS score is unavailable, and the issue is not listed in CISA’s KEV catalog, but the absence of authentication makes it a clear attack vector and poses a significant risk to confidentiality and integrity of meeting participants.