CVE-2025-61602 Details
Description
BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed `reactionEmojiId` in the GraphQL mutation `chatSendMessageReaction`. Version 3.0.13 contains a patch. No known workarounds are available.
A denial-of-service vulnerability has been identified in BigBlueButton versions prior to 3.0.13. This vulnerability allows any authenticated user to disrupt the chat functionality for all participants in a meeting. The issue arises when a malformed 'reactionEmojiId' is sent through the 'chatSendMessageReaction' GraphQL mutation. The server fails to validate this parameter, leading to a crash in the chat user interface. As a result, users are unable to read or send messages, effectively halting communication during the session.
Users are advised to upgrade to BigBlueButton version 3.0.13, which includes a patch for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-45j2-m26c-3pcm | CISA-ADP | ExploitVendor Advisory |
| https://github.com/bigbluebutton/bigbluebutton/pull/23651 | [email protected] | Issue TrackingPatch |
| https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-45j2-m26c-3pcm | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-703 | Improper Check or Handling of Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bigbluebutton bigbluebutton | < 3.0.13 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2025 | Initial Analysis | [email protected] |
| Oct 10, 2025 | CVE Modified | CISA-ADP |
| Oct 9, 2025 | New CVE Received | [email protected] |