The error path
TraceMint's review focused on an API error path rather than the success path. When a request failed validation, the response redirected the browser to a destination taken from the request. Because that destination was used without being checked against an allowlist, an attacker-chosen absolute URL was honored, turning a validation failure into an open redirect that could send a user to an external site.
The regression
The advisory identifies this as a regression introduced by changed validation-error behavior in the 3.0 line. The 2.7 line was not newly affected, so the finding is specific to how the newer release handled the failed-request redirect.
The fix
The maintainers recommend upgrading to 3.0.20 or a later patched version. Their public advisory links the corrective commit and acknowledges responsible disclosure.
The recognition
The report was handled through the maintainers’ YesWeHack program, which awarded a €1,500 bounty for the finding.
The lesson
Include exceptional control flow in security review. Failed requests can still produce externally visible behavior that crosses a trust boundary; a redirect destination has to be validated on the error path as strictly as on the success path.
Read the original record
This short note summarizes an already-public advisory. For the complete impact, remediation and credit record, see the BigBlueButton security advisory.
Editorial publication is separate from disclosure. No private discovery timeline or method has been inferred.