CVE-2026-23478
Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.
- Score
- CVSS 4.0 10.0 Critical
- Status
- Analyzed - security-advisories@github.com
- Published
- 2026-01-13
- Last modified
- 2026-01-14
- Weaknesses
- CWE-602, CWE-639
Affected products
References
- https://github.com/calcom/cal.com/security/advisories/GHSA-7hg4-x4pr-3hrg
