A newly disclosed flaw in Cal.com, the popular open-source scheduling platform, could have allowed attackers to hijack any user account simply by knowing the victim’s email address, bypassing all authentication and even multi-factor protections.
Security researcher Pedro Castro published the advisory GHSA-7hg4-x4pr-3hrg, detailing the issue, now tracked as CVE-2026-23478, and rated Critical under CVSS v4 due to its trivial exploitability and full compromise of affected accounts.
JWT callback bug turns email into a master key
The vulnerability stems from a custom NextAuth JWT callback used in Cal.com’s authentication flow.
When the callback is triggered with trigger === "update"It accepts identity fields supplied by the client and writes them directly into the JWT without server-side validation.
This means an attacker can call session.update({ email: "victim@example.com" }) and cause the server to issue a new token like:
json{ "sub": "attackerId", "email": "victim@example.com" }
Subsequent requests authenticated with this JWT are treated as originating from the victim.
Cal.com’s application logic uses the token.email field to look up the user in the database, so the session is rebuilt from the victim’s record, effectively handing over their entire account.
The issue affects Cal.com versions >= 3.1.6 and < 6.0.7. The project has released fixes in version 6.0.7 and above.
Once exploited, the flaw grants full authenticated access to the target user’s account. According to the advisory, attackers could immediately access:
- Bookings and event types
- Integrations
- Organization memberships
- Billing data
- Administrative capabilities, where applicable
Notably, 2FA and external identity providers (IdPs) do not mitigate this attack because the flaw occurs after authentication, when the session is constructed from the JWT payload.
The attack requires only a single API call and is remotely exploitable over the network, with no user interaction and no prior privileges, matching the CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N vector.
The weakness is classified under CWE-602 (Client-Side Enforcement of Server-Side Security) and CWE-639 (Authorization Bypass Through User-Controlled Key), reflecting the core design issue: the server trusted client-controlled data (email) as an authorization key without verifying that it belonged to the authenticated subject.
Cal.com reports that its hosted deployments were patched immediately and that there is currently no evidence of exploitation in the wild. The issue was reported by Jaydns using Veria-Labs tooling.
Users running self-hosted or on-premise Cal.com instances are strongly urged to upgrade to version 6.0.7 or later as soon as possible and to review custom authentication logic for similar client-trust pitfalls.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=Security researcher Pedro Castro published the advisory GHSA-7hg4-x4pr-3hrg, detailing the issue, now tracked as CVE-2026-23478,){kind=link}