Cal.com CVE-2025-66489

Exploitation targets the login credentials provider's authentication flow: supplying a TOTP code causes the flawed conditional logic to skip password verification, so the concrete prerequisite is the ability to submit a TOTP value in the login request against a Cal.com instance prior to version 5.9.8. The description's phrasing ('when a TOTP code is provided') implies the attack path is tied to the TOTP/two-factor code field, so the practical limiting factor is likely that the victim account has TOTP enabled - verify this scoping with the vendor advisory, as it materially changes the exposed account population. Beyond reachability of the login endpoint and running an unpatched version, no user interaction, privileges, or non-default configuration are required per the CVSS vector (PR:N/UI:N).

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper tiger. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity authentication bypass requiring no prior privileges or user interaction, which is the worst-case profile for an internet-facing scheduling service. Multiple signals corroborate the threat: publicly available exploit code exists, CWE-303 (incorrect implementation of authentication) matches the described conditional-logic flaw, and a vendor patch is confirmed. The one tempering signal is EPSS, which is low at 0.15% (35th percentile), and the CVE is NOT on the CISA KEV list - so there is no evidence of active, widespread in-the-wild exploitation at time of analysis, only demonstrated exploitability. The low EPSS alongside available POC code is not contradictory: EPSS reflects observed/modeled exploitation volume, and newly disclosed auth-bypass flaws in self-hosted apps often lag before EPSS rises. Net assessment: treat as urgent for any self-hosted Cal.com instance below 5.9.8, because the barrier to exploitation is minimal and working exploit logic is public, even though mass-exploitation has not yet been observed.

A remote attacker targets a Cal.com login endpoint for an account that has TOTP two-factor enabled and, by supplying a TOTP code, triggers the flawed conditional logic in the credentials provider so that password verification is skipped entirely, resulting in account takeover. Publicly available exploit code lowers the bar further, letting an unauthenticated attacker reach scheduling data, connected calendars, and account settings without ever knowing the victim's password.