CVE-2025-66489
BaseFortify
Publication date: 2025-12-03
Last updated on: 2026-02-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cal | cal.com | to 5.9.8 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-303 | The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Cal.com scheduling software prior to version 5.9.8 allows an attacker to bypass password verification when a Time-based One-Time Password (TOTP) code is provided. The issue is caused by problematic conditional logic in the authentication flow, which means that an attacker can gain unauthorized access to user accounts without needing the correct password.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to user accounts, potentially allowing attackers to impersonate users, access sensitive scheduling information, and perform actions on behalf of legitimate users. This compromises the security and privacy of user data and can lead to further exploitation or data breaches.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Cal.com scheduling software to version 5.9.8 or later, where the issue with bypassing password verification when a TOTP code is provided has been fixed.