CVE-2025-66489

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-03

Last updated on: 2026-02-13

Assigner: GitHub, Inc.

Description

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-03

Last Modified

2026-02-13

Generated

2026-07-06

AI Q&A

2025-12-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66489

EUVD

EUVD-2025-201128

Affected Vendors & Products

Vendor	Product	Version / Range
cal	cal.com	to 5.9.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-303	The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

Attack-Flow Graph

Executive Summary

This vulnerability in Cal.com scheduling software prior to version 5.9.8 allows an attacker to bypass password verification when a Time-based One-Time Password (TOTP) code is provided. The issue is caused by problematic conditional logic in the authentication flow, which means that an attacker can gain unauthorized access to user accounts without needing the correct password.

Impact Analysis

This vulnerability can lead to unauthorized access to user accounts, potentially allowing attackers to impersonate users, access sensitive scheduling information, and perform actions on behalf of legitimate users. This compromises the security and privacy of user data and can lead to further exploitation or data breaches.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Cal.com scheduling software to version 5.9.8 or later, where the issue with bypassing password verification when a TOTP code is provided has been fixed.

Hi! I’m here to help you understand CVE-2025-66489. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70