CVE-2026-23478

Name of the Vulnerable Software and Affected Versions Cal.com versions 3.1.6 through 6.0.6

Description Cal.com, an open-source scheduling software, has a critical flaw in a custom NextAuth JWT callback. This issue allows attackers to gain full authenticated access to any user's account by supplying a target email address via the session.update() function. The vulnerability bypasses protections at the session token level, potentially enabling account takeover, including access to bookings, integrations, organizational access, billing, and administrative privileges. Approximately 7,000 instances are potentially affected. The issue allows attackers to overwrite identity fields during the session.update() process and impersonate any user. Two-factor authentication and identity providers do not prevent this post-authentication session hijack. The vulnerability is related to unvalidated email input in the session.update() function.

Recommendations Cal.com versions 3.1.6 through 6.0.6 must be upgraded to version 6.0.7 or later to resolve this issue.