CVE-2026-23478
Unknown Unknown - Not Provided
Authentication Bypass in Cal.com NextAuth JWT Callback

Publication date: 2026-01-13

Last updated on: 2026-02-03

Assigner: GitHub, Inc.

Description
Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-13
Last Modified
2026-02-03
Generated
2026-06-16
AI Q&A
2026-01-14
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23478
EUVD
EUVD-2026-2413
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
calcom cal.com From 3.1.6 (inc) to 6.0.7 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Cal.com scheduling software versions from 3.1.6 to before 6.0.7. It is due to a flaw in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via the session.update() function. This means an attacker can impersonate any user without proper authorization.

Impact Analysis

The vulnerability allows attackers to gain full authenticated access to any user's account, which can lead to unauthorized access to sensitive scheduling information, potential data theft, manipulation of user data, and loss of trust in the system's security.

Mitigation Strategies

Upgrade Cal.com scheduling software to version 6.0.7 or later, as this version contains the fix for the vulnerability in the custom NextAuth JWT callback that allows attackers to gain full authenticated access by supplying a target email address via session.update().

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23478. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart