CVE-2020-26163
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2020-26163
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-26163.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2020-26163
- Published
- 2020-09-30T18:15:27.477Z
- Modified
- 2025-11-14T10:59:15.598234Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link.
- References
Affected packages
Git / github.com/bigbluebutton/greenlight
Affected ranges
- Type
- GIT
- Repo
- https://github.com/bigbluebutton/greenlight
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
release-2.*
release-2.0.0
release-2.0.1
release-2.0.2
release-2.0.3
release-2.0.4
release-2.0.5
release-2.0.6
release-2.0.7
release-2.0.8
release-2.0.9
release-2.1.0
release-2.1.1
release-2.1.2
release-2.1.3
release-2.2.0
release-2.2.1
release-2.2.2
release-2.2.3
release-2.2.4
release-2.3.0
release-2.3.1
release-2.3.2
release-2.3.3
release-2.3.4
release-2.4
release-2.4-b1
release-2.4-b2
release-2.4-b3
release-2.4-rc1
release-2.4.1
release-2.4.2
release-2.4.2-rc.1
release-2.5
release-2.5-rc.1
release-2.5.1
release-2.5.2
release-2.5.3
release-2.5.4
release-2.5.5