CVE-2025-66489
Cal.com Authentication Bypass via bad TOTP + password checks
Résumé
Cal.com Authentication Bypass via bad TOTP + password checks
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov