CVE-2025-55200: BigBlueButton Shared Notes XSS Vulnerability

CVE-2025-55200 Overview

CVE-2025-55200 is a stored Cross-Site Scripting (XSS) vulnerability in BigBlueButton, an open-source virtual classroom platform. The flaw exists in the Shared Notes feature in versions prior to 3.0.13. A low-privileged user can set a malicious Username that is rendered without proper sanitization on the Shared Notes page when they edit content. When a higher-privileged user such as an administrator opens that page, the attacker's JavaScript executes in the victim's browser session. The issue is tracked under [CWE-79] and resolved in version 3.0.13.

Critical Impact
A low-privileged meeting participant can execute arbitrary JavaScript in the browser of administrators who open Shared Notes, enabling session abuse and client-side account actions.

Affected Products

BigBlueButton versions prior to 3.0.13
BigBlueButton bbb-pads component versions prior to v1.5.4
Deployments exposing the Shared Notes feature to untrusted participants

Discovery Timeline

2025-10-09 - CVE-2025-55200 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55200

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the collaborative Shared Notes component of BigBlueButton. The injection sink is the Shared Notes page, which renders participant usernames alongside editing activity indicators. When a participant with a crafted username begins editing content, their name is written into the Shared Notes DOM without adequate output encoding. Any viewer of the page, including moderators and administrators, executes the attacker-controlled script in their own authenticated session.

The attack is cross-privilege. The attacker needs only low-privileged participant access, yet the payload runs in the browser of any user who views the compromised Shared Notes. This enables theft of session artifacts, abuse of in-session APIs, defacement of notes, or chained actions using the victim's permissions.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The Username field is treated as trusted display text when rendered in the Shared Notes editor view. The fix in BigBlueButton pull request #23693 and the companion bbb-pads pull request #67 introduces proper encoding of the username before it reaches the DOM.

Attack Vector

Exploitation is network-based and requires the attacker to join a session as a participant. The attacker sets a username containing an HTML or JavaScript payload before or when joining. Once admitted to a meeting, the attacker opens Shared Notes and begins editing. The malicious username is then rendered to every user who opens that Shared Notes view, triggering execution in their browser context.

See the GitHub Security Advisory GHSA-9jv9-cjrm-grj2 for the vendor's technical description. No public proof-of-concept exploit is listed for this CVE.

Detection Methods for CVE-2025-55200

Indicators of Compromise

Participant usernames containing HTML characters such as <, >, ", ', or substrings like <script, onerror=, or javascript:.
Unexpected outbound requests from administrator browsers to attacker-controlled domains originating during or shortly after Shared Notes activity.
Shared Notes DOM content containing script fragments or injected event handlers tied to the username display element.

Detection Strategies

Inspect BigBlueButton meeting join logs and bbb-pads logs for usernames containing script-like syntax or non-printable payload patterns.
Deploy a Content Security Policy (CSP) report-only header on the BigBlueButton frontend and monitor CSP violation reports for inline script execution attempts.
Correlate web proxy telemetry with meeting timestamps to identify browser-initiated requests from staff accounts that align with Shared Notes sessions involving external participants.

Monitoring Recommendations

Ingest BigBlueButton application and bbb-pads logs into your SIEM and alert on usernames matching regex patterns indicating markup or script.
Track the installed BigBlueButton version across hosts and alert on any instance running below 3.0.13.
Monitor administrator and moderator sessions for anomalous API calls that occur immediately after they open a Shared Notes page.

How to Mitigate CVE-2025-55200

Immediate Actions Required

Upgrade BigBlueButton to version 3.0.13 or later and update bbb-pads to v1.5.4 or later across all nodes.
Audit active and recent meetings for participants whose usernames contain HTML or script characters and revoke their access.
Rotate administrator session cookies and credentials if evidence of exploitation is found.

Patch Information

The fix is delivered in BigBlueButton 3.0.13 via pull request #23693 and in bbb-pads via pull request #67, released as bbb-pads v1.5.4. Review the full GitHub Security Advisory GHSA-9jv9-cjrm-grj2 for upgrade guidance.

Workarounds

Restrict meeting join to authenticated users through your LMS or SSO integration and disallow guest-chosen display names where feasible.
Enforce a strict server-side username validation policy that rejects characters such as <, >, ", ', and & at account provisioning and meeting join.
Disable the Shared Notes feature in meeting configurations until the patched version is deployed.

bash

# Example username validation at a reverse proxy using NGINX
# Reject join requests with usernames containing HTML metacharacters
location /bigbluebutton/api/join {
    if ($arg_fullName ~* "[<>\"'&]") {
        return 400 "Invalid username";
    }
    proxy_pass http://bbb_backend;
}