PT-2025-48991 · Cal.Com · Cal.Com

Published

2025-12-03

·

Updated

2026-01-14

·

CVE-2025-66489

CVSS v4.0

9.9

Critical

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
Name of the Vulnerable Software and Affected Versions Cal.com versions prior to 5.9.8
Description Cal.com, an open-source scheduling software, has a flaw in its login credentials provider. This issue allows an attacker to bypass password verification if a TOTP (Time-Based One-Time Password) code is provided during login. This bypass occurs due to problematic conditional logic within the authentication flow. Approximately 983 exposed instances and 15.2K services are potentially affected. The issue allows full account takeover by submitting fake TOTP codes, potentially degrading login security to single-factor TOTP validation for users with two-factor authentication enabled. The vulnerability is triggered when the password check is skipped if the totpCode parameter contains any non-empty value. The vulnerable API endpoint is '/api/auth/callback/credentials', and the vulnerable parameters are password and totpCode.
Recommendations Upgrade to version 5.9.8 to restore proper password and TOTP validation.

Exploit

Fix

Weakness Enumeration

CWE-303

Related Identifiers

CVE-2025-66489
GHSA-9R3W-4J8Q-PW98

Affected Products

Cal.Com