CVE-2026-23478
Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback
Résumé
Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov