Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-23478

Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

calcom cal.com

  • >= 3.1.6, < 6.0.7affected

References