← Vulnerability feed

Vulnerability record · CVE-2026-23478 · published 13 January 2026

CVE-2026-23478: Cal.com insecure direct object reference vulnerability

Cal · Cal.Com

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.

10.0 CVSS 4.0 Critical EPSS 0.46% · top 62.7% CWE-602 · CWE-602CWE-639 · Insecure direct object reference
10.0CVSS 4.0 base score
0.46%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/calcom/cal.com/security/advisories/GHSA-7hg4-x4pr-3hrg Third Party Advisory

Track CVE-2026-23478 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2025-66489Cal.com vulnerabilityCal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verificati…EPSS 0.84%8.8CVE-2023-1647Cal.com improper access control vulnerabilityImproper Access Control in GitHub repository calcom/cal.com prior to 2.7.EPSS 0.84%5.4CVE-2023-37919Cal.com insufficient session expiration vulnerabilityCal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2F…EPSS 0.31%

Source: NIST National Vulnerability Database (record CVE-2026-23478), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.