CVE-2025-66489
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-03

Last updated on: 2026-02-13

Assigner: GitHub, Inc.

Description
Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-03
Last Modified
2026-02-13
Generated
2026-06-16
AI Q&A
2025-12-03
EPSS Evaluated
2026-06-14
NVD
CVE-2025-66489
EUVD
EUVD-2025-201128
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
cal cal.com to 5.9.8 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-303 The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Cal.com scheduling software prior to version 5.9.8 allows an attacker to bypass password verification when a Time-based One-Time Password (TOTP) code is provided. The issue is caused by problematic conditional logic in the authentication flow, which means that an attacker can gain unauthorized access to user accounts without needing the correct password.

Impact Analysis

This vulnerability can lead to unauthorized access to user accounts, potentially allowing attackers to impersonate users, access sensitive scheduling information, and perform actions on behalf of legitimate users. This compromises the security and privacy of user data and can lead to further exploitation or data breaches.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Cal.com scheduling software to version 5.9.8 or later, where the issue with bypassing password verification when a TOTP code is provided has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-66489. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart