Vulnerabilities

TI-2026-18911 CVE-2026-23478

Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback

MEDIUM 49

Cal.com is open-source scheduling software.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00466 Published 2026-01-13 Fixed in 6.0.7 CWE-602

TI-2025-40913 CVE-2025-66489

MEDIUM 44

Cal.com is open-source scheduling software.

CVSS 4.0CRITICAL 9.9 Network No auth No interaction EPSS 0.00967 Published 2025-12-03 Fixed in 5.9.8 CWE-303

TI-2023-19352 CVE-2023-37919

MEDIUM 62

Cal.com is open-source scheduling software.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00314 Published 2023-07-25 No fix listed CWE-613

TI-2023-01550 CVE-2023-1647 · GHSA-976q-qhh2-p88c

MEDIUM 42

Improper Access Control in GitHub repository calcom/cal.com prior to 2.7.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00842 Published 2023-03-27 Fixed in 2.7 CWE-284