Open Redirect in cal.diy Conferencing OAuth Callback

Executive Summary

CVE-2026-63768 is an open redirect vulnerability in cal.diy versions 6.2.0 and earlier. It affects the conferencing OAuth callback endpoint where attackers can manipulate the unsigned state parameter and onErrorReturnTo field to redirect users to arbitrary malicious URLs. This occurs because the state parameter is parsed as JSON without validation, allowing unauthenticated redirects from the trusted domain.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unexpected redirects from your cal.diy domain. Check OAuth callback endpoints for unsigned state parameters or onErrorReturnTo fields in URLs. Inspect server logs for 301 redirects to external domains originating from /apps/api/v2/src/modules/conferencing/controllers/conferencing.controller.ts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to perform phishing attacks by tricking users into visiting attacker-controlled domains from the trusted cal.diy site. Victims may unknowingly follow links that appear to come from the legitimate API domain, leading to credential theft or malware downloads. The exploit requires no authentication or prior interaction, making it easy to execute.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to the risk of phishing attacks. Open redirect flaws may allow attackers to redirect users to malicious sites, leading to unauthorized data access or disclosure. GDPR requires protecting user data from unauthorized access, while HIPAA mandates secure handling of sensitive health information. Exploitation of this flaw could undermine these protections by tricking users into disclosing credentials or sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch from cal.diy pull request #29681 which validates callback destinations using getSafeConferencingRedirectUrl. Ensure state parameters are signed and validated. Block unauthenticated redirects by adding authentication guards to the conferencing controller endpoint. Update to version 6.2.1 or later.

Useful 0 Not Useful 0