CVE-2026-63768 is an open redirect vulnerability affecting cal.diy through version 6.2.0. The issue exists in the conferencing OAuth callback endpoint where attackers can manipulate the unsigned state parameter and onErrorReturnTo field to redirect users to arbitrary URLs. This vulnerability enables attackers to redirect users from the legitimate cal.diy domain to attacker-controlled sites, facilitating phishing attacks. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and limited impact on confidentiality and integrity.

Successful exploitation allows attackers to redirect users silently from the trusted cal.diy domain to malicious external URLs. This can be used to conduct phishing attacks, potentially leading to credential theft or other social engineering outcomes. There is no direct impact on system confidentiality, integrity, or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious of unexpected redirects from cal.diy OAuth callback endpoints and avoid clicking suspicious links. Monitoring for updates from the vendor calcom is recommended to apply any forthcoming patches or official mitigations.