CVE-2025-66489

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/calcom/cal.com/security/advisories/GHSA-9r3w-4j8q-pw98	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cal:cal.com:*:*:*:*:*:*:*:*

History

18 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Cal.com es un software de programación de código abierto. Versiones anteriores a 5.9.8, una falla en el proveedor de credenciales de inicio de sesión permite a un atacante omitir la verificación de contraseña cuando se proporciona un código TOTP, obteniendo potencialmente acceso no autorizado a las cuentas de usuario. Este problema existe debido a una lógica condicional problemática en el flujo de autenticación. Esta vulnerabilidad se corrige en 5.9.8.

Information

Published : 2025-12-03 20:16

Updated : 2026-10-18 18:10

NVD link : CVE-2025-66489

Mitre link : CVE-2025-66489

CVE.ORG link : CVE-2025-66489

JSON object : View

Products Affected

cal

cal.com

CWE

CWE-303

Incorrect Implementation of Authentication Algorithm

{"id": "CVE-2025-66489", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66489", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T21:48:18.299562Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "calcom", "product": "cal.com", "versions": [{"status": "affected", "version": "< 5.9.8"}]}]}], "published": "2025-12-03T20:16:27.057", "references": [{"url": "https://github.com/calcom/cal.com/security/advisories/GHSA-9r3w-4j8q-pw98", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-303"}]}], "descriptions": [{"lang": "en", "value": "Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8."}, {"lang": "es", "value": "Cal.com es un software de programaci\u00f3n de c\u00f3digo abierto. Versiones anteriores a 5.9.8, una falla en el proveedor de credenciales de inicio de sesi\u00f3n permite a un atacante omitir la verificaci\u00f3n de contrase\u00f1a cuando se proporciona un c\u00f3digo TOTP, obteniendo potencialmente acceso no autorizado a las cuentas de usuario. Este problema existe debido a una l\u00f3gica condicional problem\u00e1tica en el flujo de autenticaci\u00f3n. Esta vulnerabilidad se corrige en 5.9.8."}], "lastModified": "2026-10-18T18:10:00.100", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cal:cal.com:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97D8E07A-0C42-4AD4-8270-3929F5A4D472", "versionEndExcluding": "5.9.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}