Critical Cal.com Vulnerability Let Attackers Bypass Authentication and Hijack any User Account

Cybersecuritynews •Abinaya • January 15, 2026

A critical authentication bypass vulnerability in Cal.com’s scheduling platform enables attackers to hijack any user account by exploiting a flaw in the NextAuth JWT callback mechanism. Tracked as CVE-2026-23478, this vulnerability affects versions from 3.1.6 up to but not including 6.0.7, with patches available in version 6.0.7 and later. The vulnerability resides in a custom […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cal.com Vulnerability Allows Account Hijacking via Authentication Bypass A critical vulnerability in Cal.com's scheduling platform allows attackers to bypass authentication and hijack user accounts. Tracked as CVE-2026-23478, this flaw affects versions from 3.1.6 to below 6.0.7, with patches available in version 6.0.7 and later. The issue is linked to a weakness in the NextAuth JWT callback mechanism. 2 sources 57

Extracted Entities

Critical Cal.com Vulnerability Let Attackers Bypass Authentication and Hijack any User Account

The full story

Extracted Entities

Companies (1)

CVEs (1)

Platforms (1)