calcom cal.com vulnerabilities

Latest calcom cal.com CVEs

Newest publication first

1. CVE-2026-112043 calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization

   Published 2026-10-19

   Medium·CVSS 5.3 EPSS 0.36%

   A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to auth...

2. CVE-2026-109143 calcom cal.com/cal.diy Credentials delete credentials.delete privileges management

   Published 2026-10-13

   Medium·CVSS 5.3 EPSS 0.22%

   A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege m...

3. CVE-2026-23478 Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback

   Published 2026-01-13

   Critical·CVSS 10.0 EPSS 0.47%

   Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerab...

4. CVE-2025-66489 Cal.com Authentication Bypass via bad TOTP + password checks

   Published 2025-12-03

   Critical·CVSS 9.9 EPSS 0.97%

   Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic con...

5. CVE-2023-37919 Cal.com not expiring old sessions after enabling 2FA

   Published 2023-07-25

   Medium·CVSS 5.4 EPSS 0.31%

   Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other devi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.