Back to CVE Browser

CVE-2020-26163

HIGH

8.8

CVSS Severity Score

EPSS Score0.1580%

EPSS Percentile41.03th

PublishedSep 30, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link.

Affected Platforms (CPE)

📦

Bigbluebutton

Greenlight

< 2.5.6

References & Advisories

🔗 https://github.com/bigbluebutton/greenlight/pull/1543

🔗 https://github.com/bigbluebutton/greenlight/releases/tag/release-2.5.6

🔗 https://www.sakshamanand.com/host-header-injection-bigbluebutton/

🔗 https://github.com/bigbluebutton/greenlight/pull/1543

🔗 https://github.com/bigbluebutton/greenlight/releases/tag/release-2.5.6

🔗 https://www.sakshamanand.com/host-header-injection-bigbluebutton/

Related Vulnerabilities

CVE-2020-276426.1

A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2....

CVE-2020-276124.3

Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information leak to us...

CVE-2026-121917.8

A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdri...

CVE-2026-121905.3

A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of the compo...