Read the docs
TI-2026-45355 Aliases CVE-2026-63768GHSA-5wvx-w47w-mg4x

cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

Priority LOW 24CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00342 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
calcomcal.diyup to 6.2.0—No fix listedCNA
  • cal.diy Vendorcalcom Affected up to 6.2.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63768
  2. 2026-10-03 Alias added: GHSA-5wvx-w47w-mg4x

References

Exploit 1

Patch 1

  • TI-2024-38439 Cal.com through 4.7.15 Cross-Site Scripting via booking questions CVSS 4.0CRITICAL 9.3
  • TI-2024-38437 Cal.com through 4.7.15 Cross-Site Scripting via booking questions CVSS 4.0CRITICAL 9.3
  • TI-2024-38438 cal.com Repository Takeover via pull_request_target Workflow CVSS 4.0HIGH 8.5
  • TI-2026-08199 calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure CVSS 4.0MEDIUM 6.9
  • TI-2023-19352 Cal.com not expiring old sessions after enabling 2FA CVSS 3.1MEDIUM 6.5
  • TI-2026-76231 Authorization bypass in cal.com and cal.diy webhook handler CVSS 4.0MEDIUM 5.3
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences