VYPR
← All advisories
Unrated severityOSV Advisory· Published Jan 13, 2026· Updated Jan 14, 2026

Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback

CVE-2026-23478

Description

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Calcom/Cal.comOSV2 versions
    @calcom/atoms@1.0.110, @calcom/atoms@1.0.112, @calcom/atoms@1.0.114, …+ 1 more
    • (no CPE)range: @calcom/atoms@1.0.110, @calcom/atoms@1.0.112, @calcom/atoms@1.0.114, …
    • (no CPE)range: >=3.1.6, <6.0.7

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.