CVE-2026-23478
Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback
概要
Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov