Critical severity9.8OSV Advisory· Published Jan 13, 2026· Updated Jun 17, 2026
CVE-2026-23478
CVE-2026-23478
Description
Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3@calcom/[email protected], @calcom/[email protected], @calcom/[email protected], …+ 1 more
- (no CPE)range: @calcom/[email protected], @calcom/[email protected], @calcom/[email protected], …
- (no CPE)range: 3.1.6 to <6.0.7
Patches
Vulnerability mechanics
References
1- github.com/calcom/cal.com/security/advisories/GHSA-7hg4-x4pr-3hrgnvdThird Party Advisory
News mentions
0No linked articles in our index yet.