PT-2026-61691 · Cal.Com · Cal.Diy

George Chen · CVE-2026-63768 · Publicado 2026-07-20 · Atualizado 2026-07-20

NVD

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-63768

Produtos afetados

Cal.Diy

Referências · 4

• 🔥 https://github.com/calcom/cal.diy/issues/29679 · Exploit
• https://github.com/calcom/cal.diy/pull/29681 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63768 · Nota de Segurança
• https://vulncheck.com/advisories/cal-diy-conferencing-oauth-callback-open-redirect-via-unsigned-state · Nota