CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-01-13
Cal.com Account Takeover via NextAuth Session Update Vulnerability (CVE-2026-23478)
[Affected Scope] Cal.com versions from 3.1.6 to before 6.0.7
[Impact] Attackers can gain full authenticated access to any user's account by supplying a target email address via session.update() without credentials
[Mitigation] Immediately upgrade Cal.com to version 6.0.7 or later