Gbhackers

Cal.com Vulnerability Allows Account Hijacking via Authentication Bypass

First seen 15 Jan 2026, 14:53 UTC • Cybersecuritynews

•57.3

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A critical vulnerability in Cal.com's scheduling platform allows attackers to bypass authentication and hijack user accounts. Tracked as CVE-2026-23478, this flaw affects versions from 3.1.6 to below 6.0.7, with patches available in version 6.0.7 and later. The issue is linked to a weakness in the NextAuth JWT callback mechanism.

How this analysis works

Attack Flow

Continue Reading

Cal.com Transitions to Closed Source Due to AI-Driven Security Risks New CVE Lite CLI Tool Audits AI Security Overrides for JavaScript Dependencies Cal.com Vulnerability Allows Bypass of Authentication with Fake TOTP Codes Cal.com Vulnerabilities Lead to Account Takeover and Data Exposure

Cal.com Vulnerability Allows Account Hijacking via Authentication Bypass

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading