BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.