CVE-2026-63768

Name of the Vulnerable Software and Affected Versions cal.diy versions 6.2.0 and earlier

Description An open redirect issue exists in the conferencing OAuth callback endpoint. Attackers can redirect users to arbitrary URLs by crafting malicious state parameters, specifically exploiting the unsigned state parameter and the onErrorReturnTo field. This allows visitors to be silently redirected from a trusted domain to attacker-controlled URLs, which can be used for phishing attacks.

Recommendations Update cal.diy to a version later than 6.2.0.