CVE-2026-23478 — Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback

CVE-2026-23478

Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback PUBLISHED

Description (CNA)

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.

Affected (CNA)

Vendor / product	Versions
calcom / cal.com	affected >= 3.1.6, < 6.0.7

CWE

CWE-602, CWE-639

References

https://github.com/calcom/cal.com/security/advisories/GHSA-7hg4-x4pr-3hrg

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.