CVE-2026-23478
Authentication Bypass in Cal.com NextAuth JWT Callback
Publication date: 2026-01-13
Last updated on: 2026-02-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| calcom | cal.com | From 3.1.6 (inc) to 6.0.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-602 | The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. |
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Cal.com scheduling software versions from 3.1.6 to before 6.0.7. It is due to a flaw in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via the session.update() function. This means an attacker can impersonate any user without proper authorization.
How can this vulnerability impact me? :
The vulnerability allows attackers to gain full authenticated access to any user's account, which can lead to unauthorized access to sensitive scheduling information, potential data theft, manipulation of user data, and loss of trust in the system's security.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Cal.com scheduling software to version 6.0.7 or later, as this version contains the fix for the vulnerability in the custom NextAuth JWT callback that allows attackers to gain full authenticated access by supplying a target email address via session.update().