CVE-2025-61602
BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId
Summary
BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId
Original description
The description as published by the source.
BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed reactionEmojiId in the GraphQL mutation chatSendMessageReaction. Version 3.0.13 contains a patch. No known workarounds are available.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com