CVE DatabaseCVE-2026-23478

Updated 2026-06-17한국어 권고문 →

CVE-2026-234789.8/CRITICALCWE-602CWE-639

Cal.com Account Takeover via NextAuth Session Update Vulnerability (CVE-2026-23478)

⚡ Jump to Patch

Affected Vendors

calcom

Affected Components

cal.com

Published Date

2026-01-13

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

0.5%

FIRST.org

CISA KEV

Not Listed

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Cal.com versions from 3.1.6 to before 6.0.7

Impact

Attackers can gain full authenticated access to any user's account by supplying a target email address via session.update() without credentials

Mitigation

Immediately upgrade Cal.com to version 6.0.7 or later

Affected Products & Version Scope

Cal.com versions 3.1.6 through 6.0.6 (Fixed in 6.0.7)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official security patch by upgrading your Cal.com instance to version 6.0.7 or higher.

bash

# Navigate to your Cal.com directory
cd /path/to/calcom

# Fetch tags and checkout the patched version
git fetch --tags
git checkout v6.0.7

# Install dependencies and rebuild the application
yarn install --frozen-lockfile
yarn build

# Restart the application process (e.g., using PM2)
pm2 restart calcom

2. Temporary Workaround & Hardening Configuration

If an immediate upgrade is not feasible, restrict access to the session update endpoint at the reverse proxy level (e.g., Nginx) to mitigate unauthorized session manipulation.

nginx

# Nginx configuration snippet to restrict session update requests
server {
    listen 80;
    server_name cal.yourdomain.com;

    location /api/auth/session {
        limit_except GET {
            # Restrict session updates to trusted internal networks if applicable
            allow 127.0.0.1;
            deny all;
        }
        proxy_pass http://localhost:3000;
    }
}

3. Log Audit & IoC Verification Commands

Verify your current running version and inspect application logs for suspicious session update activities.

bash

# 1. Check the currently installed version in package.json
cat /path/to/calcom/package.json | grep '"version"'

# 2. Search application logs for session update API calls and potential exploitation attempts
grep -i -E 'session.*update|/api/auth/session' /var/log/calcom/*.log

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

To prevent unauthorized account takeover, immediately upgrade your Cal.com deployment to version 6.0.7 or later.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2026-23478) exists in the open-source scheduling software Cal.com, specifically within its custom NextAuth.js JWT callback implementation. When the session.update() method is triggered, the application fails to properly validate the client-side input (CWE-602, CWE-639). This allows an authenticated session to rewrite its own identity token with arbitrary values, leading to complete authentication bypass.

2. Exploitation Mechanics & Attack Scenario

An attacker logs into a low-privileged account and invokes the NextAuth client-side update() function via the browser console or direct API requests. By passing a payload containing a target victim's email address ({ email: 'victim@target-domain.com' }), the vulnerable custom JWT callback on the server accepts this input without verification. The server then regenerates the JWT session token mapped to the victim's identity, granting the attacker full access to the victim's account.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical), this vulnerability poses an extreme risk. Successful exploitation allows complete account takeover of any user, including administrators. Attackers can access sensitive scheduling data, steal integrated third-party API keys (e.g., Google Calendar, Zoom), and manipulate critical business workflows, leading to severe data breaches and compliance violations.

Official Vendor Advisories & References

NVD Original English Description

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.

https://github.com/calcom/cal.com/security/advisories/GHSA-7hg4-x4pr-3hrg

Source: security-advisories@github.com · Third Party Advisory

Frequently Asked SecOps Questions (CVE-2026-23478)

FAQ

Q1. How critical is CVE-2026-23478 and is it actively exploited in the wild?

CVE-2026-23478 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 0.5%. Organizations running affected versions should prioritize patching based on network exposure.

Q2. Which vendors and products are affected by CVE-2026-23478?

Primary impacted vendors include calcom across cal.com. Scope summary: Cal.com versions 3.1.6 through 6.0.6 (Fixed in 6.0.7)

Q3. What temporary mitigations or workarounds exist for CVE-2026-23478 before patching?

[Mitigation] Immediately upgrade Cal.com to version 6.0.7 or later Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION