Critical Cal.com Flaw (CVE-2025-66489, CVSS 9.9) Allows Authentication Bypass by Submitting Fake TOTP Codes

The article reports a critical flaw in Cal[.]com, tracked as CVE-2025-66489 with a CVSS score of 9.9, that could allow attackers to bypass authentication, including password verification and 2FA. At the core is a logic error in the authorize() function where the system may skip password checks if a TOTP code is provided, effectively giving unauthorised access in some scenarios.

The flaw creates two attack paths: a bypass for non-2FA users who can login by submitting any non-empty totpCode value, and a downgrade of 2FA for users who have enabled 2FA, since the password factor is still ignored. Affected versions are 5.9.7 and earlier, with a fixed release in 5.9.8, and administrators are urged to upgrade to 5.9.8 to restore the integrity of the authentication flow. According to the advisory, Cal[.]com has released a patch to close the loophole.