CVE-2025-61602
📋 TL;DR
This vulnerability allows any authenticated user in a BigBlueButton virtual classroom meeting to crash the chat functionality for all participants by sending a malformed reactionEmojiId in a GraphQL mutation. All BigBlueButton instances running versions prior to 3.0.13 are affected.
💻 Affected Systems
- BigBlueButton
📦 What is this software?
Bigbluebutton by Bigbluebutton
⚠️ Risk & Real-World Impact
Worst Case
An attacker could repeatedly exploit this vulnerability to disrupt chat communication in critical meetings, causing complete denial of service for chat functionality across all meetings on the server.
Likely Case
Malicious or accidental users crash chat functionality in meetings, disrupting communication and requiring meeting restarts or server intervention.
If Mitigated
With proper authentication controls, only authenticated users can exploit, but chat functionality remains vulnerable to disruption from any participant.
🎯 Exploit Status
Exploitation requires authenticated access to a meeting but is simple to execute via GraphQL mutation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.13
Vendor Advisory: https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-45j2-m26c-3pcm
Restart Required: Yes
Instructions:
1. Backup your BigBlueButton configuration and data. 2. Update to version 3.0.13 using your package manager (apt-get upgrade bigbluebutton). 3. Restart BigBlueButton services (bbb-conf --restart). 4. Verify the update with bbb-conf --check.
🔧 Temporary Workarounds
No official workarounds
allThe vendor advisory states no known workarounds exist.
🧯 If You Can't Patch
- Restrict meeting access to trusted users only and monitor for chat disruption incidents.
- Implement network monitoring for GraphQL mutation patterns targeting chatSendMessageReaction.
🔍 How to Verify
Check if Vulnerable:
Check BigBlueButton version with command: dpkg -l | grep bigbluebutton. If version is earlier than 3.0.13, system is vulnerable.Check Version:
dpkg -l | grep bigbluebuttonVerify Fix Applied:
After patching, verify version is 3.0.13 or later with same command and test chat reaction functionality in a meeting.📡 Detection & Monitoring
Log Indicators:
- GraphQL errors related to chatSendMessageReaction mutation
- Chat service crashes or restarts in logs
Network Indicators:
- Unusual volume of GraphQL mutation requests to chatSendMessageReaction endpoint
SIEM Query:
source="bigbluebutton.logs" AND ("chatSendMessageReaction" OR "reactionEmojiId") AND error