Critical Cal.com Vulnerability Let Attackers Bypass Authentication and Hijack any User Account
A significant vulnerability has been identified in Cal.com's scheduling platform, affecting authentication processes. This flaw, tracked as CVE-2026-23478, permits attackers to hijack user accounts by exploiting a weakness in the NextAuth JWT callback…
A significant vulnerability has been identified in Cal.com's scheduling platform, affecting authentication processes. This flaw, tracked as CVE-2026-23478, permits attackers to hijack user accounts by exploiting a weakness in the NextAuth JWT callback mechanism.
The vulnerability impacts Cal.com versions from 3.1.6 up to, but not including, 6.0.7. Patches have been released starting with version 6.0.7. The issue arises from a custom NextAuth JWT callback that inadequately manages client-controlled identity inputs during session updates.
CVE ID: CVE-2026-23478 Affected Versions: >= 3.1.6 < 6.0.7 CVSS v4 Score: Critical / 10 Attack Vector: Network CWE-602: Client-Side Enforcement of Server-Side Security CWE-639: Authorization Bypass Through User-Controlled Key
The vulnerability allows an attacker to execute an API call using the session.update({email: "victim@example.com"}), altering the JSON Web Token (JWT) to incorporate the attacker's subject identifier along with the victim's email. Subsequent requests with this modified JWT authenticate as the victim, as the application utilizes the token email field controlled by the attacker to query the user database.
A significant vulnerability has been identified in Cal.com's scheduling platform, affecting authentication processes.
The exploitation of this flaw grants complete control over victim accounts, including access to bookings, event types, integrations, organization memberships, billing details, and administrative privileges. The attack can be executed at scale with minimal effort, requiring only the target's email address and a single API call. Cal.com has patched hosted deployments following the discovery.
Organizations using self-hosted instances of Cal.com are advised to upgrade to version 6.0.7 or later to mitigate this risk. The vulnerability was reported by a security researcher through Veri-Labs, with no indication of active exploitation in the wild. The flaw exemplifies the potential consequences of inadequate client-side control over server-side security mechanisms, even in otherwise secure platforms.
For further technical details, please refer to the official advisory .
Based on reporting by Cyber Security News.