The vulnerability resides in BigBlueButton’s presentation URL validation logic. Before version 3.0.23 it did not enforce restrictions on redirects that resolve to site‑local or link‑local IP addresses, allowing a presentation URL to point to internal network hosts. The issue was addressed in 3.0.23 by pinning resolved IPs during redirect handling. This flaw corresponds to CWE‑918.

All deployments of BigBlueButton running a version prior to 3.0.23 are affected. The fix is included in release 3.0.23 and later, as documented in the project’s commit history and security advisory.

The CVSS score of 6.8 places the vulnerability in the medium‑to‑high risk range. The EPSS score of less than 1 % indicates a low likelihood of exploitation at present, and the vulnerability is not listed in CISA KEV, implying no widespread exploitation. Based on the description, it can be inferred that the issue may be exploited by delivering a malicious presentation link to a user, causing the client to be redirected to a site‑local address.