EUVD-2026-46073
GHSA-5wvx-w47w-mg4x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no auth (PR:N), requires victim to follow crafted link (UI:R), scope changes as redirect crosses to attacker domain (S:C), with low confidentiality risk via phishing and low integrity impact from redirect manipulation.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.
AnalysisAI
Open redirect in cal.diy's conferencing OAuth callback endpoint (through v6.2.0) enables remote unauthenticated attackers to silently redirect authenticated users to attacker-controlled URLs by injecting a malicious external URL into the unsigned onErrorReturnTo field of the OAuth state parameter. Because the state payload is never cryptographically signed or validated against a trusted origin allowlist, the endpoint blindly issues a 301 redirect to any URL supplied by the caller, making the trusted cal.diy domain a transparent phishing launchpad. No public exploit code has been identified at time of analysis, but exploitation requires only a crafted URL - no special tooling - with user interaction as the sole barrier.
Technical ContextAI
cal.diy is a self-hosted open-source scheduling platform (a community variant of Cal.com) built on a NestJS API v2 backend. The vulnerable component is ConferencingController in apps/api/v2/src/modules/conferencing/controllers/conferencing.controller.ts. During OAuth authorization flows for conferencing integrations such as Zoom, the callback endpoint accepts a state query parameter containing a JSON-encoded object with fields including onErrorReturnTo (the fallback redirect URL on OAuth error), fromApp, accessToken, and optionally teamId/orgId for org-scoped flows. Because this state object is transmitted unsigned and without server-side origin validation, any caller can embed an arbitrary external URL. The root cause is CWE-601 (URL Redirection to Untrusted Site): user-controlled input flows directly into an HTTP 301 redirect without origin checking. The upstream fix in PR #29681 enforces that all redirect targets must match the configured app.cal.com origin, falling back to the safe path /apps/installed/conferencing for any external value, and additionally rejects malformed or non-object state values entirely.
RemediationAI
Apply the upstream fix from PR #29681 (https://github.com/calcom/cal.diy/pull/29681), which introduces origin validation for all redirect targets in the conferencing OAuth callback controller - enforcing that URLs must resolve to the configured app.cal.com origin and falling back to the safe internal path /apps/installed/conferencing for any external value. An exact tagged release version incorporating this fix was not confirmed in available data; monitor the cal.diy GitHub repository (https://github.com/calcom/cal.diy) for a release that includes PR #29681. As a compensating control prior to patching, operators can configure a reverse proxy or WAF rule to reject or sanitize requests to /v2/conferencing/*/oauth/callback where the decoded state parameter's onErrorReturnTo field contains an external origin; this carries the trade-off that overly strict rules may interfere with legitimate OAuth error handling if misconfigured. Disabling conferencing OAuth integrations entirely eliminates the attack surface at the cost of losing those integrations.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today