BigBlueButton 3.0.16 → 3.0.33
17 releases · 2 breaking changes · 19 security fixes · 16 advisories fixed
19security2breaking1deprecated62feature218fix
Vulnerabilities fixed by this upgrade
- 5.4 GHSA-j43j-jmqf-2fg6 Missing server-side enforcement of the maximum number of custom poll options
- 9.8 GHSA-q8vx-4cgc-7w4w Improper Authentication through /api/join via POST parameter "auth"
- 9.9 GHSA-h2rp-mcch-vgh9 Stored XSS in annotation through /graphql via GraphQL Mutation "url"
- 5.4 CVE-2026-55491 Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
- 4.9 CVE-2026-55489 IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass
- 7.1 CVE-2026-46355 Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
- 8.5 CVE-2026-46682 Blind SQL Injection AUTH (Moderator)
- 8.1 CVE-2026-46353 BigBlueButton API checksum bypass via presentationUploadExternalUrl
- 6.8 CVE-2026-46404 Presentation URL Security Hardening
- 8.1 CVE-2026-46351 Insecure Randomness allows to guess user's conference session token and impersonate them
- 8.9 CVE-2026-27737 Stored XSS in bbb-playback replay
- 6.5 CVE-2026-41127 Missing authorization allows viewer to inject/overwrite captions
- 4.3 CVE-2026-41126 Open Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL"
- 6.1 CVE-2026-27736 Open Redirect vulnerability in ApiController
- 2.0 CVE-2026-27467 Audio from participants to the server initially unmuted
- 7.2 CVE-2026-27466 Exposed ClamAV port allowing denial of service
Breaking changes
- breaking Ref(html5): Remove non-used settings in 3.0.25
- breaking indirectly: * fix(tldraw): remove unnecessary extra zoom call + in 3.0.19
Security changes
- security fix: Block embeddable shape types in whiteboard annotations by @Tainan404 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h2rp-mcch-vgh9 in 3.0.29
- security fix(bbb-web): Reject GET-Only Endpoint Requests With Request Bodies by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q8vx-4cgc-7w4w in 3.0.29
- security fix(playback): prevent stored XSS in recording playback by @germanocaumo https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-57p5-c888-74f9 in 3.0.29
- security fix(akka-apps): Verify Meeting ID on Presentation Delete Message by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-jxpq-r3h3-p75g in 3.0.29
- security Missing authorization allows viewer to inject/overwrite captions https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q387-2q28-mg33 in 3.0.24
- security Open Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8 in 3.0.24
- security fix(bbb-web): Make ApiController Helper Methods Private contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr will be made public not earlier than March 24, 2026 in 3.0.23
- security fix(core): enforce maxCustom poll settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j43j-jmqf-2fg6 will be made public not earlier than March 24, 2026 in 3.0.23
- security fix(akka-apps): Use Bind Parameters in SQL Query contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5 will be made public not earlier than March 24, 2026 in 3.0.23
- security fix(bbb-web): Fix Presentation Download URL Validation by @paultrudel @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h will… in 3.0.23
- security fix(core): enforce chat min-max character settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-qfv6-rv7x-6rq6 will be made public not earlier than March 24, 2026 in 3.0.23
- security Fix(akka): restrict markdown chat content contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3m6h-47j2-83r4 will be made public not earlier than Feb 24, 2026 in 3.0.22
- security [3.0]chore: clamav tighten command contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc will be made public not earlier than Feb 24, 2026 in 3.0.22
- security fix(bbb-web): Prevent Checksum Bypass With PresentationUploadExternalUrl contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-43hc-5g2m-cqff will be made public not earlier than Feb 10, 2026 in 3.0.21
- security fix(bbb-web): Use Secure PRNG for ID and Token Generation contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-7959-pf2v-xc4h will be made public not earlier than Feb 10, 2026 in 3.0.21
- security fix(audio): ensure MediaStreamTrack is disabled on first join + mute contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-6gj9-5rhm-68j8 will be made public not earlier than Feb 10, 2026 in 3.0.20
- security fix(bbb-web): Ignore ErrorRedirectUrl on Checksum Validation Failure contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx will be made public not earlier than Feb 10, 2026 in 3.0.20
- security [Snyk] Security upgrade lodash from 4.17.21 to 4.17.23 in 3.0.20
- security build: bbb-playback to 5.4.3 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8vv7-vj94-q2pv will be made public not earlier than Feb 2, 2026 in 3.0.19
Deprecations
- deprecated [3.0 external video share] remove deprecated parameters in 3.0.26
Every release in between
fixfix(poll): drop out-of-range answerIds to avoid log noise
fixfix(html5): add real Panopto player to external video share
fixfix(html5): prevent crash from browser auto-translation
fixfix(video-provider): preview real user avatars in the camera overflow tile
fixfix(video): never let the grid overflow tile consume a camera slot, +
fixfix(quick-poll): keep parenthetical text in Smart Slides poll question
fixfix(html5): re-center microphone glyph in audio modal
fixfix(html5): correct recording timer when client clock is ahead of server
fixfix(html5): retry locale fetch on transient network failure
other[chore] fix children PropType in PresentationDownloadDropdownWrapper
fixfix: Presentation download: filename containing "&" is truncated and saved without its extension
fixfix: grid-aware resize snapping in camera dock
fixfix(html5): prevent white flash on slide change
fixfix: broadcast external video seek detected via onProgress discontinuity
otherBackport: "fix(audio): assorted fixes and improvements to LiveKit's floor manager"
fixfix(external-video): restore audio when autoplay starts the video muted
featurefeat(shared-notes): markdown export, init-from-markdown, and import modal
featurefeat: New useTimer hook
other[3.0] refactor(audio): better BBBLiveKit state reconciliation on reconnects, [email protected] #25550
othertest: add BlockNote shared notes e2e tests (backport of #25165)
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherchore: update SDK to version 0.0.103
featurefeat(plugins): support configurable button styles
featurefeat(plugin-sdk): add senderRole to useLoadedChatMessages
fixfix(akka-apps): [development] Correctly start bbb-apps-akka by creating symlinks
fixfix(bbb-web): Handle Null Meeting IDs on IsMeetingRunning Requests
fixfix(bbb-web): render a response when insertDocument body has no presentation module
fixfix(core): API parameter downloadable is not working
otherrefactor(bbb-web): process pre-uploaded slides async on a bounded pool
fixfix: MeetingActor analytics discards VoiceUserState.callerName, logs ERROR after user leaves
fixfix: The .csv export for LAD has the user 'Anonymous'
fixfix(recording): Ruby 3.2 File.exists? deprecation in BigBlueButton recording sanity worker
feature[3.0] build: Pull new image bumping Go and Nodejs
otherchore(bbb-conf): Add virtualBackgroundsDisabled to list of retired pr…
fixfix(document): add --build for development scripts of bbb-web
otherDocs: Add presentation parameter current
otherdocs: clarify allowOverrideClientSettingsOnCreateCall is a server setting, not a /create param
fixfix(docs): use valid font-weight for Open Sans SemiBold @font-face
otherDocs: Clarify voiceBridge range
otherdocs: Documentation catchup on 3.0 new features/configs since 3.0.28
+33 more items in the release notesfixfix(accessibility): change page title based on the content
fixfix(whiteboard): prevent crash when slide changes while a viewer is editing
fixfix(accessibility): Non-text contrast is insufficient
fixfix(shared-notes): prevent collaboration cursor name from leaking into links
fixfix: SVG support for notifications
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherchore: update SDK version for the last we have published
fixfix(bbb-graphql-server): lower connection_lifetime to limit Postgres memory growth
fixfix(bbb-export-annotations): rasterize background slides to prevent ODF export cropping (#25303)
fixfix(bbb-export-annotations): add viewBox to background slides missing one to prevent ODF export cropping
fixFix allowPromoteGuestToModerator
featureAdd analytics logging for breakout move-user request
otherSet MALLOC_ARENA_MAX=2 for bbb-web and bbb-apps-akka
otherchore: upgrade export-annotations dependencies
otherchore: upgrade bbb-shared-notes-server dependencies
otherbuild(deps): bump form-data from 3.0.4 to 3.0.5 in /bbb-learning-dashboard
otherbuild(deps): bump ws in /bbb-learning-dashboard
otherbuild(deps): bump ws from 7.5.10 to 7.5.11 in /docs
otherbuild: Bump Hasura from 2.48.14 to 2.49.3
otherbuild(deps): bump markdown-it from 14.1.1 to 14.2.0 in /bigbluebutton-html5
otherbuild(deps): bump form-data from 4.0.5 to 4.0.6 in /bigbluebutton-tests/playwright
fixfix(video-provider): show raised hand indicator on audio-only tiles
fixfix(chat): preserve text before links in reply message preview
featureAdd client setting to not display guest lobby position
fixFix breakout webcams only for moderator lock
fixfix(screenshare): keep startScreensharing name in minifier for tablet app
fixfix: Unified Layout: tile count plus aggregated users does not match total participant count (3.0)
fixfix(client): Accessibility updates
fixfix(html5): escape emoticon auto-conversion with a leading backslash
fixfix(audio): reinforce mute state on LK publish and reconnects
featurefeat(html5): Hide sessionToken from address bar
otherrefactor (graphql/html5): Always show most recently pinned user first, followed by the others
featureperf(html5): Enable json patch for GridUsers subscription (and reduce payload significantly)
otherstyle(client): Support plugin-specified button color in actions bar
othertest: updates to Whiteboard
otherwebpack: ignore .yalc/ from file watching and exclude tldraw from managed-path version caching for 3.0
otherTests: add Unified Layout minimize regression tests
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
featurefeat(plugins): stop screenshare and upload presentation
fixfix(presentation): snapshot of current slide is blank under cluster-proxy
fixfix(bbb-web): Return Better Errors From Presentation Upload
fixfix(akka, bbb-web): clientSettingsOverride fails silently
fixfix(shared-notes-server): export empty notes as a blank file, not an error
otherrefactor (gql-middleware): Enable the custom json patcher for subscriptions with user_camera type
featurefeat(LAD): add standalone build mode for LAD
fixfix(recording): reduce mem usage when audio cut extends into gap
fixrecording: Fix processing hangs from seeking in screenshare files with video
fixrecording: Fix hang in audio processing
featurefeat(recording): disable formats per meeting
otherbuild(bbb-web): Nginx cleanup
otherbuild(freeswitch): v1.11.1 (up from v1.10.12)
otherbuild(freeswitch): pick relevant changes from v1.11.0/1 into v1.10.12
otherdocs: Updated the options for the 'meetingLayout' parameter to include 'PARTICIPANTS_AND_CHAT_ONLY'.
otherdocs: Prepare docs changes for BBB 3.0.30
otherbuild(deps html5 client): bump launch-editor from 2.8.1 to 2.14.1 in /bigbluebutton-html5
otherbuild(deps-dev): bump launch-editor from 2.8.0 to 2.14.1 in /bbb-graphql-client-test
otherchore: Add SonarQube configuration for project analysis
otherchore: Merge 3.0.29 into v3.0.x-develop
otherchore: BigBlueButton 3.0.30 iteration
securityfix: Block embeddable shape types in whiteboard annotations by @Tainan404 https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h2rp-mcch-vgh9
securityfix(bbb-web): Reject GET-Only Endpoint Requests With Request Bodies by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q8vx-4cgc-7w4w
securityfix(playback): prevent stored XSS in recording playback by @germanocaumo https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-57p5-c888-74f9
securityfix(akka-apps): Verify Meeting ID on Presentation Delete Message by @paultrudel https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-jxpq-r3h3-p75g
fixfix: bn- table crash with static toolbar
fixfix: activating the listen-in function results in an error (drop out of user from the breakout room)
fixfix (html5/shared-notes-server): Read-only fixes and new version for BlockNote
fixfix (html5/bbb-web): Preloading of slides not working for proxy setups
fixfix: Talking indicator some letters are cut off
fixfix (html5): Fix genaral blocknotes issues related with losing focus
fixfix(accessibility): settings dropdown keyboard navigation
fixfix (shared-notes-server): Simplify permission handling
fixfix (shared-notes-server): Badge not being showed when shared notes is changed (in BlockNote)
fixfix (shared-notes-server/cluster): Use $bbb_cors_origin for shared-notes-server Allow-Origin (CORS)
otherref: change text align select button to remove previous selector
featurefeat(livekit): add forceRelay/forceRelayOnFirefox settings, +
featurefeat(accessibility): add Esc shortcut to move focus in/out of the BlockNote shared notes editor
otherperf (html5): Improve video stream queries for server performance
featurefeat: Added patched flag to users basic info subscription
fixfix (tests): make Play/Pause test env-independent by comparing screenshots dynamically
fixfix(tests): stabilize "Upload multiple presentations" against toast race
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherrefactor (akka-apps / LAD): Improve session grouping after disconnect
otherrefactor(core): create public media groups groups lazily, +
otherperf (gql-middleware): improve json patcher, produce minimal patches via LCS-based move generation
featurefeat(core): recording parameter passthrough to breakouts
featurefeat(core): allow moderators to manage lock settings inside breakout rooms and optionally inherit parent meeting lock settings on creation
fixfix(core): breakout: propagate parent client settings override
fixfix(bbb-web): Enforce Presentation File Size Limits On All Paths
fixfix: Recordings break on nfs
otherRevert "fix: Recordings break on nfs"
fixfix(recording): address ffmpeg high memory usage from video PTS gaps
featurerecording: add internal docs for video edl/layout
otherbuild(shared-notes-server): Add postgresql-14 as a dependency in opts…
otherbuild(bbb-playback): Bump to bbb-playback to v5.4.7
otherbuild(deps): [email protected] (up from 2.17.1)
otherdocs: add CLAUDE.md with operational notes for the Docusaurus site
otherdocs: document bigbluebutton.properties additions in BBB 3.0.27
otherUpdate action text and documentation link
otherdocs: Add some missing properties of manifest.json in the docs
otherchore: update @bigbluebutton/tldraw from alpha.33 to alpha.34
otherbuild(deps): bump the npm_and_yarn group across 2 directories with 2 updates
otherchore: update @bigbluebutton/tldraw from alpha.34 to alpha.35
otherbuild(deps): bump the npm_and_yarn group across 6 directories with 1 update
+8 more items in the release notesfixfix(html5): restore Ctrl+Z / Ctrl+Shift+Z in BlockNote
fixfix: Poll/quiz publishing does not show notification to viewers
fixfix: Guests note missing / disappearing
fixfix: lockSettingsHideUserList leaks usernames in the chat if a viewer was (temp) set to presenter
fixfix(client): Fix Android being too greedy with Safari user agent (fixes #24295)
fixfix: Fix performance issue with block-note dark mode
fixfix(breakouts): user id handling
fixFix(html5): Presenter whiteboard camera position moving on window resizing
fixfix: fix hardcoded colors scheme for exported notes.html
fixfix: bn- table crash with static toolbar
featurefeat: Enable users to pan outside the current presenters view during infinite whiteboard
otherrefactor(livekit): memoize useMediaSenders result (selective sub)
otherref: decrease size of block-note toolbar
fixfix (ci/tests): Stabilize cross-page slide comparison
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
fixfix(bbb-web): Add Callback URL Validation
otherrefactor (gql-middleware): Minor improvements
otherrefactor(bbb-web): Update Plugin URL Handling
fixfix (gql-server): Set typing=false once user edited a message
featurefeat: cache plugin manifest files with bbb-web
fixfix(presentation): Require SessionToken and PageToken on Presentation Page Requests
other[3.0 recording] fix: external video recording not shown after screenshare
fixfix(recording): add presentation minimized events + screenshare as content fixes
fixfix(recording): Fix events archiving on servers with blocknote
otherbuild: Update bbb-pads branch to v1.5.11
otherbuild: bump bbb-playback to 5.4.5
otherbuild: Update bbb-playback branch to v5.4.6
otherdocs(administration): fix typos in lti.md
otherdocs: rebuild "Other meeting configs available" table
otherchore: Migrate from deprecated GitHub Stale App to actions/stale, exempt milestone issues
otherchore: Replace defunct behaviorbot/welcome app with GitHub Actions workflow
otherchore: Expand welcome workflow first-time contributor detection
otheriteration: BigBlueButton 3.0.27
otherbuild(deps): bump the npm_and_yarn group across 2 directories with 1 update
otherbuild(deps): bump the npm_and_yarn group across 3 directories with 1 update
otherbuild(deps): bump ip-address from 10.1.0 to 10.2.0 in /bbb-learning-dashboard in the npm_and_yarn group across 1 directory
otherbuild(deps): bump the npm_and_yarn group across 4 directories with 1 update
otherbuild(deps): bump mermaid from 11.12.3 to 11.15.0 in /docs in the npm_and_yarn group across 1 directory
fixfix(html5): keep loading screen during graphql retries and show error screen on connection timeout
fixfix(html5): prevent pinch-to-zoom for viewers and WB users on touch devices
fixfix: suppress join/leave notifications for locked viewers when hideUserList is active
fixfix (html5): Export of Block Notes broken for cluster setup
fixfix: blocknote placeholder wrap when container size too small
other[3.0 port] fix: exclude audio-only tiles from SFU subscription and plugin buttons
featurefeat (html5): Implement static toolbar for BlockNote
deprecated[3.0 external video share] remove deprecated parameters
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client
otherchore(livekit): enable reconnectOnFatalFailure by default
fixfix(livekit): dial-in unable to be heard by web users
other[3.0 port] fix(bbb-web): respond to /create before downloading pre-uploaded presentations
fixfix(bbb-web): Upgrade Dependencies
fixrecording: Fix hang when deskshare audio ends before video
fixfix (build): Install XDG_RUNTIME_DIR drop-in in Docker for bbb-shared-notes-server
otherdocs: Document lockSettingsHideViewersAnnotation /create parameter
otherdocs: Fix livekit setup commands
otherdocs: Mention sharedNotesEditor was added as a create param
otherdocs: Refactor/restructure BBB 3.0 api changes to be more readable
otherdocs: Fix - strings were being interpreted as True
otherdocs: Simplify bbb-web dev instructions
otherdocs: Document events.xml LayoutBroadcastedEvent addition
otherdocs: Fix typos and iterate over 3.0 docs
otherdocs: bump bbb version to 3.0.26
other[3.0 doc] Guide to use developing html5 client
otherci: bump GitHub Actions to Node 24 versions
fixfix(whiteboard): prevent presenter/viewer viewed-region desync after fullscreen
fixFix(html5): Make the cursor point respect the pointerDiameter setting
fixfix(html5): Notifications being clipped on mobile
fixfix(html5): fix question detection and indented option matching
fixfix: review breakout room moderator actions
fixfix: Breakouts: viewers sent to waiting lobby
fixFix(html5): WB camera position change on slide change when zoom applied
fixFix(html5): zoom with mouser wheel not being centered
fixfix: client crashes when a invalid layout is set in local storage(port to 3.0)
fixfix(html5, tests): only display allowed shapes in edit mode
fixfix(chat): display message timestamp using locale-aware time format
fixFix(html5): cursor zoom misalignment
fixFix(html5): cursor appearing on wrong position to viewers
fixfix: State events leak between user sessions or tabs
featurefeat: Block note integration
breakingRef(html5): Remove non-used settings
featurefeat: extend audio groups to cameras and screen sharing
otherrefactor(livekit): review camera and screen sharing quality presets and simulcast layers
featurefeat(livekit): option to use LiveKit as the client's audio state source
featurefeat(livekit): add a last N-like system to selective subscription (audio)
fixfix(livekit): only display screenshare volume control if there's audio
fixfix(livekit): use LK APIs for WebRTC stats gathering, fix edge cases
featurefeat(html5): Automate asset compression with Webpack
fixfix(html5): exclude .gz files from language selector list
otherRef(html5): Make webcam show ui on hover or touch hold
otherci: remove 3rd-party packages pull + install
othertests: update connection status tests
othertests: update flaky tests
fixfix(plugin-sdk): screenshare blocks snapshot of current slide for plugin-sdk
fixfix(plugin-sdk): Change loading value of a subscription when data didn't change
fixfix(LAD): Generic data keeps updating in plugin's table
featurefeat(plugin-sdk): Add svg icon for all extensible areas
fixfix(bbb-web): Disable External Entity Parsing in XML Services
featurefeat (bbb-web): Introduce a new /create param clientSettingsOverrideJsonUrl
fixfix(akka-apps): Remove Unnecessary Akka Apps Logging
fixfix(bbb-web): Upgrade Grails and Spring Boot
fixfix(bbb-web): Prevent SVGs From Being Generated With Zero Value Dimensions
fixFix(akka): Add Disable feature support for plugins
fixfix(LAD): Legacy dasboard data files not working with newer version of BBB
fixfix(recording): Address A/V sync issues, glitches on cuts, ffmpeg memory usage (audio)
+36 more items in the release notessecurityMissing authorization allows viewer to inject/overwrite captions https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q387-2q28-mg33
securityOpen Redirect on bigbluebutton through bigbluebutton/api/join via get-parameter "logoutURL" https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8
fixFix(html5): The video preview and audio modals open even with the lock settings settings enabled
fixfix: trim spaces of external video url
otherUpdate external video label to remove unsupported platform
fixfix: WhiteBoard Ctrl+D work only once
fixfix: userdata-bbb_override_default_locale is ineffective in guest lobby
otherBreakouts: ensure moderator only functionality is not shown
featurefeat: Make webcamBackgroundURL available in breakouts
fixFix(html5): Space bar key problem on WB
otherstyle: Improve visual hierarchy and UX of guest lobby screen by @tylercopeland @ramonlsouza
fixFix(html5): Recalculate time sync when a new minimal rtt is available
fixfix: talking indicator behind webcam area - custom and smart layouts
fixfix(html5): session details closing when user talks
fixfix(whiteboard): scope slide zoom state to presentation id by @ramonlsouza @germanocaumo
otherrefactor(client): Reword You have been banned message
otherchore: temporarily disable breakout audio transfer UI when using LiveKit
othertest: add test cases for external video
fixfix (ci): attempt to fix: Error: Input required and not supplied: token for Cleanup Playwright reports workflow
otherci: avoid running GH workflows after PR is merged when it's not necessary at this point
other[3.0 locales] Updates for project BigBlueButton v3.0 HTML5 client https://github.com/bigbluebutton/bigbluebutton/pull/24667 https://github.com/bigbluebutton/bigbluebutton/pull/24733
otherUpdates for project BigBlueButton v3.0 HTML5 client and language eu
fixfix (akka-apps): Prevent race condition when a user joins a breakout room
fixfix (gql-server): Not re-assigning users to their last breakout room
fixfix (akka-apps): not storing user activity for breakout rooms (only main meeting)
otherrefactor(core): Breakouts moderator vs viewer
otherrefactor: drop logging of password/authToken
securityfix(bbb-web): Make ApiController Helper Methods Private contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr will be made public not earlier than March 24, 2026
securityfix(core): enforce maxCustom poll settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j43j-jmqf-2fg6 will be made public not earlier than March 24, 2026
fixfix: Additional checks in polls
securityfix(akka-apps): Use Bind Parameters in SQL Query contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5 will be made public not earlier than March 24, 2026
securityfix(bbb-web): Fix Presentation Download URL Validation by @paultrudel @gustavotrott in https://github.com/bigbluebutton/bigbluebutton/commit/7ccc60c965d744d9fb637715052352a1e59a2c27 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-xqm3-6q7q-4v5h will…
securityfix(core): enforce chat min-max character settings on akka contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-qfv6-rv7x-6rq6 will be made public not earlier than March 24, 2026
otherchore(recording): Bump bbbevents to 2.0.3
fixfix(recording): Detect system sender correctly in breakouts recording
otherRecording: avoid short cuts in audio processing
otherbuild: require running redis for bbb-export-annotations.service
otherbuild: [email protected] (up from v1.9.9), [email protected] (up from v2.3.1), +
otherbuild: Update .gitlab-ci.yml with Go 1.26.0 and NodeJS 22.22.0
featureAdd firewalld support to apply-lib.sh
fixfix(conf): Avoid bbb-conf noise on empty bigbluebutton.properties
featurefeat(conf): Warn about retired bbb-web properties
+6 more items in the release notesfixFix(html5): Annotations get transferred to another presentation
otherrefactor: camera custom pagination settings
fixfix (html5): Always include presenter in cursors list
otherRefactor(html5): Improve deduplication logic for toastify
fixfix(audio): missing CC icon in talking indicator (mediasoup/FS)
fixfix: userdata-bbb_auto_share_webcam=true causes webcams to stay enabled when joining breakout rooms
fixfix: Leave meeting button oversize area
otherrefactor: remove unused component
fixfix: pushLayout default settings
fixfix: audio modal should have precedence over video modal
featureIntroduce showAudioOnlyOnFirstPage and maxAudioOnlyUsers settings
fixFix(html5): Eraser not being persisted in the batch
fixfix: audio-only tiles appear in all layouts
othertest(docs): Update README and remove config for browsers not fully supported
otherrefactor: Add data-test to a few user-list components
fixfix(workflow): Update publish-results workflow with robust PR resolution, cleanup, and in‑progress rerun handling
fixfix(workflow): Publish test-results under workflow ID
othertests: adjust toast element check
othertest(chore): [Snyk] Security upgrade axios from 1.12.2 to 1.13.5 https://github.com/bigbluebutton/bigbluebutton/pull/24632
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et https://github.com/bigbluebutton/bigbluebutton/pull/24600
otherrefactor (gql-middleware): Make message caches meeting-scoped
securityFix(akka): restrict markdown chat content contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3m6h-47j2-83r4 will be made public not earlier than Feb 24, 2026
fixfix(core): Fix transcription problem with multiple users speaking at the same time
fixfix(export): respect autoSize property for text annotations
otherchore(export-annot): Bump axios to 1.13.5 by @antobinary in https://github.com/bigbluebutton/bigbluebutton/pull/24640
fix[3.0]docs: Fix broken links
otherdocs: Adjust wording of welcome message location
security[3.0]chore: clamav tighten command contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc will be made public not earlier than Feb 24, 2026
fixFix(html5): presentation moving to old position when enable infinite WB
fixFix(html5): missing space in some locales on waiting room queue
featurefeat(ci): Restore upload of merge HTML reporter to publish tests
fixfix(ci): refine conditions for publishing test results and handling blob reports
otherUpdates for project BigBlueButton v3.0 HTML5 client and language hu_HU
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ar
securityfix(bbb-web): Prevent Checksum Bypass With PresentationUploadExternalUrl contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-43hc-5g2m-cqff will be made public not earlier than Feb 10, 2026
securityfix(bbb-web): Use Secure PRNG for ID and Token Generation contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-7959-pf2v-xc4h will be made public not earlier than Feb 10, 2026
fixfix (akka-apps): list of breakout rooms doesn't update when user is promoted/demoted
otherref(plugin): refactor the code of plugin logger to be more robust
fixfix(bbb-conf): Use turnutils_stunclient instead of old stun 0.97 client
otherbuild: Bump bbb-pads to 1.5.7
otherbuild: Bump bbb-pads to 1.5.8
otherdocs: Add docs for meta_analytics-callback-url
otherdocs: set a random domain as example in Docs
fixfix(livekit): trigger forced room reconnection on fatal errors
fixfix(livekit): frozen cams on reconn, camera bridge improvements
fixfix(livekit): frozen screen share on reconnects
other[3.0] fix(chat): audio alerts playing when panel is opened
fixfix: drop areas appearing when presentation is removed
fixfix (html5): Show chat message notification from html version of the message (instead of markdown)
fixfix: Virtual background image upload fails when userdata-bbb_hide_notifications is set to true
fixfix(html5/chat): Remove unstable chat scrolling log
fixFix(html5): chat counter stale due race condition on mark message as read
fixfix: Raise hand notification not working for second moderator
fixfix(html5): exclude worker.ts from ReactRefresh so hot reload can work
fixfix: Leave button opens empty dropdown
fixFix(html5): talking indicator being covered by webcam
otherrefactor(html5): Replace isMeteorConnected prop with isConnected across UI components
securityfix(audio): ensure MediaStreamTrack is disabled on first join + mute contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-6gj9-5rhm-68j8 will be made public not earlier than Feb 10, 2026
fixFix(html5): moderators were unable to unlock users via the Raised Hand list.
fixfix(audio): legacy listen only broken due to undefined argument
fixFix(html5): Pinch zoom not propagating on WB
fixFix(html5): enforce meetingId filtering across user-related data streams
fixfix(plugins-sdk): compare generic content items by their id
featurefeat(plugin): Add nameSortable and bot in the UsersBasicInfo data hook
featurefeat(plugin): added z-index to floating-window
featurefeat: added more fields to useMeeting hook and created a projection feature
featurefeat(publish-reports): add action to publish Playwright reports to GitHub Pages
fixfix(workflows): update repository references for Playwright reports
fixfix(workflows): Add artifact existence check for test reports in automated tests workflow
featurefeat (gql-server): Add breakout room participant activity tracking
featurerefactor (gql-middleware): Reject new mutations once the rate limit is reached, instead of delaying them
featurechore (gql-middleware): Introduce a config to dump queries to files (for debugging)
fixFix(graphql-server): Change type of some breakout name related fields to text
securityfix(bbb-web): Ignore ErrorRedirectUrl on Checksum Validation Failure contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx will be made public not earlier than Feb 10, 2026
featurefeat(LAD/akka): Added new functions for the plugin to publish data to LAD
featurefeat: added fields IP, User-Agent, Referer and sessionToken to UserJoinedMeetingEvtMsg
fixFix(akka, html5): Prevent upload error notifications when converting breakout rooms with no changes
fixfix(bbb-web): Fallback to Using Blank Files if Page Downscaling Fails
featurerecording: Add archival of learning analytics dashboard
featurefeat(recording): Recording dynamic video
fixfix(recording): Add check for notes_id undefined in events_worker.rb
fixfix: Build replaces part of variable names with client version
security[Snyk] Security upgrade lodash from 4.17.21 to 4.17.23
+35 more items in the release notesfeaturefeat: Layout System Revamp (no dialog, intro of Unified layout)
featurefeat: Layout System Revamp (Camera sorting and pagination)
fixfix(client): Fix possible undefined function
fixfix(livekit): broken volume control for plugin SDK and away mode
fixfix(livekit): SIP calls aren't accepted w/o published audio tracks
fixfix(livekit): stricter measures to prevent publish-unpublish loops, +
fixfix: Lock Settings should not be visible in breakout rooms
fixfix: LiveKit token update fails on database
fixfix(html5/user-list): Append both user name and user id
fixfix(tldraw): remove unnecessary extra zoom call +
fixfix: Can't start a quiz with "true/false" or "yes/no/abstention" in languages other than english
otherstyle(poll): Increase visible area of typed responses
fixfix: unified layout updates
feature(tests): Add tests for "create breakout rooms" buttons
feature(tests): Add tests for breakout rooms sharing audio and video
feature(tests): Add test for "group parameters" (breakout room pre-selection)
feature[3.0] Adds the test upload multiple presentation on ci
otherchore(client): [Snyk] Security upgrade validator from 13.12.0 to 13.15.22
otherchore: Drop SVG presentation file support (client side)
otherUpdates for project BigBlueButton v3.0 HTML5 client and language tr
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ar
otherUpdates for project BigBlueButton v3.0 HTML5 client and language it_IT
otherUpdates for project BigBlueButton v3.0 HTML5 client and language ru
otherUpdates for project BigBlueButton v3.0 HTML5 client and language et
otherrefactor(bbb-web): Remove Support For SVG Uploads
otherchore(bbb-graphql-actions): [Snyk] Security upgrade express from 5.0.1 to 5.2.0
fixfix(sec): core: Bump spring-data-commons from 3.4.4 to 3.4.10
fixfix(sec): core: bbb-web commons-validator bump from 1.7 to 1.10.0
otherchore(core): Bump scalaVersion from 2.13.9 to 2.13.18
fixfix(bbb-web): Fix defaultHTML5ClientUrl trailing slash
fixfix(sec): core: Update tika related bbb-web dependencies
fixfix(bbb-web/akka): Error while loading plugins
fixfix: Do not allow private chat in Breakouts if it the parent room had it locked
otherrefactor: move pinned notes notification to backend
breakingindirectly: * fix(tldraw): remove unnecessary extra zoom call +
otherbuild(livekit): [email protected], [email protected], [email protected], @livekit/[email protected]
otherbuild: make bbb-web nginx config not executable
otherbuild(livekit): [email protected] (up from v1.9.4)
otherbuild(bbb-webrtc-sfu): v2.21.1
securitybuild: bbb-playback to 5.4.3 contains a security fix https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8vv7-vj94-q2pv will be made public not earlier than Feb 2, 2026
+3 more items in the release notesotherUpdates for project BigBlueButton v3.0 HTML5 client and language de
otherbuild(bbb-webrtc-sfu): v2.21.0
featurefeat: New raise hand experience
fixFix(html5): Normalize correct answer to match options in QuickPollDropdown
fixfix: chat alert styles
fixfix(html5): Notification bar positioning
fixfix: do not enforce muteOnStart on dial-in participants, make behavior configurable
fixfix(livekit): mitigate audio publish timeouts from overlapping calls
fixfix(html5/whiteboard): Wrap annotation removals into remote change
fixfix: When locked settings for shared notes are applied, links in shared notes don't open in new window
fixfix: Poll Custom input don't work with .txt file
fixfix(html5/chat): Can't remove reactions
fixFix(html5): External video modal no longer opens unexpectedly on presenter change
fixfix: presence label margin
fixfix(html5/whiteboard): Do not allow unwanted shape deletion (local-only)
fixFix(html5): duplicated session joining full audio
fixfix(audio): edge cases with permission reset and input device rollbacks
fixFix(html5): System messages in sequence did not display the time
fixfix(html5): prevent local state mutation causing desync on modal close
fixFix(html5): tldraw capturing link edit input events
featureFeat(html5): Move rtt-check fetch to a worker
fixFix(html5): Make the share webcam removes away status
featureRef(html5): Re-introduce raise hand audio notification and full user options for raised hand users list
fixfix(audio): broken mute toggle when using LiveKit
fixfix: add null safety check for breakout room join
feature(tests): Add test for "Data savings", webcam and screensharing
featureci (feat): New workflow "Cleanup caches after PR merge"
fixfix(layout/plugin): Fix blue screen when updating generic content
featurefeat: New styling for custom chat messages and permission for editing custom plugin messages
fixfix(plugins/data-channel): Fix multiple connections not receiving data from data-channel
fixfix: webcam plugin helper overlaps menu
fixfix(plugin/data-channel): Fix data-channel interface type
featurefeat: Add prop version to plugins manifest to avoid browser caching
featurefeat(plugin): private chat messages commands
fixfix: Remove invalid fields on publiccode.yml
fixfix (bbb-web): Fix timeout units for pdftotext and generateThumbnail (seconds passed instead of milliseconds)
fixfix (bbb-web): systemd-run failures caused by accumulated failed transient units
fixfix(bbb-web): Improve SVG Dimension Calculation Speed
featureupdate(recording): add LayoutBroadcastedRecordEvent to events.xml
featureLAD (feat): Add more data (notes and annotations) to LAD data file
featurefeat(LAD): Add new activity columns (wb annotations and shared notes)
featurerecording: Add support for multiple presets to 'video' recording format
+60 more items in the release notes