Cal.com NextAuth JWT Callback Authentication Bypass Vulnerability

A vulnerability exists in Cal.com scheduling software versions 3.1.6 prior to 6.0.7, within a custom NextAuth JWT callback. This vulnerability allows attackers to gain full authenticated access to any user's account by sending a target email address through session.update(). The JWT is then modified to include the attacker's ID and the victim's email, enabling access to the victim's account and associated data.

Impact

Exploitation of this vulnerability allows attackers to gain full authenticated access to any user's account, including access to bookings, event types, integrations, organization memberships, billing information, and admin privileges, if applicable.

Remediation

Users can update to Cal.com version 6.0.7 or later to address this vulnerability.