Cal
Monthly
Cal.com scheduling software (3.1.6 to 6.0.7) has a critical authentication bypass in the NextAuth JWT callback. Attackers can gain full access to any user account by supplying a target email via session.update(). Fixed in 6.0.7.
Authentication bypass in Cal.com before 5.9.8 allows remote unauthenticated attackers to skip password verification by submitting a TOTP code in the login flow, potentially taking over accounts where TOTP is enabled. Publicly available exploit code exists, and while the EPSS score is low at 0.15% (35th percentile), the vendor has released a fix in 5.9.8. The independent assessment rates this as a genuine high-priority issue with network reachability and no user interaction required.
Cal.com is open-source scheduling software. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Access Control in GitHub repository calcom/cal.com prior to 2.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cal.com scheduling software (3.1.6 to 6.0.7) has a critical authentication bypass in the NextAuth JWT callback. Attackers can gain full access to any user account by supplying a target email via session.update(). Fixed in 6.0.7.
Authentication bypass in Cal.com before 5.9.8 allows remote unauthenticated attackers to skip password verification by submitting a TOTP code in the login flow, potentially taking over accounts where TOTP is enabled. Publicly available exploit code exists, and while the EPSS score is low at 0.15% (35th percentile), the vendor has released a fix in 5.9.8. The independent assessment rates this as a genuine high-priority issue with network reachability and no user interaction required.
Cal.com is open-source scheduling software. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Access Control in GitHub repository calcom/cal.com prior to 2.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.