One API Call to Hijack: Critical Cal.com Flaw (CVE-2026-23478, CVSS 10) Bypasses 2FA

A critical vulnerability in Cal[.]com, tracked as CVE-2026-23478 with a CVSS score of 10.0, allows a remote attacker to completely bypass authentication and hijack any user account by knowing the victim’s email address. According to GHSA-7hg4-x4pr-3hrg, the flaw stems from a custom NextAuth JWT callback that failed to validate input during session updates, permitting client-controlled identity fields when the session trigger is set to update.

An attacker can simply issue a single API call—session[.]update({ email: “victim@example[.]com” })—and the server would rewrite the JWT to bind the attacker’s session to the victim’s email, causing subsequent requests to authenticate as the victim. The impact is total: access to bookings, event types, billing information and organisation memberships, with security features such as 2FA effectively bypassed.

The vulnerability affects self-hosted Cal[.]com versions 3.1.6 through 6.0.6, and the team has released version 6.0.7 to fix it, while official hosted users were reportedly patched immediately with no indication of exploitation in the wild.