Cal.Com
CVE-2026-23478
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted session.update() request with target email
-
ExploitBypass JWT callback validation
-
ExecutionHijack authenticated session
-
ImpactAccess victim's account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service Server-side security enforcement
|
| Exploitation Conditions | Cal.com versions 3.1.6 through 6.0.6 with custom NextAuth JWT callback enabled. Attacker must have network access to the Cal.com instance and ability to call session.update() method, typically accessible to unauthenticated users or those with minimal privileges. |
| Impact | CVSS 9.8 (Critical). No auth, network vector, low complexity. Cal.com is widely used for scheduling – compromise reveals calendar data, meeting links, and integration credentials. EPSS 0.10%. |
| Exploit ScenarioDerived | An attacker creates an account on Cal.com, then calls session.update() with the target user's email. Their session is updated to the target's account, granting full access to their calendar, bookings, and connected integrations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Cal.com scheduling software (3.1.6 to 6.0.7) has a critical authentication bypass in the NextAuth JWT callback. Attackers can gain full access to any user account by supplying a target email via session.update(). Fixed in 6.0.7.
Earlier versions of this analysis (1)
Cal.com allows unauthenticated account takeover through JWT callback manipulation via session.update().
RemediationAI
Update to Cal.com 6.0.7.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
A custom NextAuth JWT callback allows the session.update() function to change the authenticated user by accepting a target email address (CWE-602). An attacker can update their session to point to any user account.
Know when Cal.Com gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.
Executive ViewAI
Organizations using Cal.com face critical risk from CVE-2026-23478 rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB