Host Header Injection Flaw in BigBlueButton Greenlight Software by BigBlueButton

CVE-2020-26163

What is CVE-2020-26163?

BigBlueButton Greenlight versions prior to 2.5.6 are susceptible to Host Header Injection attacks, which can trigger account takeover scenarios. This vulnerability exploits HTTP headers such as Host and Origin, enabling an attacker to craft a malicious password-reset link. If users follow this link, they may inadvertently compromise their accounts, leading to unauthorized access. It is crucial for users to upgrade to version 2.5.6 or later to mitigate this risk.

References