Threats affecting pkg:github/calcom/cal.com

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to the affected public booking page, enabling session cookie theft, forged authenticated requests, and wormable propagation by chaining with CSRF-able endpoints to persist payloads on additional events.

CVE-2026-23478 is a critical vulnerability in cal.com versions from 3.1.6 up to before 6.0.7, where a flaw in a custom NextAuth JWT callback allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability arises from client-side enforcement of server-side security controls, violating proper authorization checks. It has a CVSS 4.0 score of 10.

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8.