by Kastro
Paper/Archive/CVE-2025-66489

CVE-2025-66489

calcom cal.com — Cal.com Authentication Bypass via bad TOTP + password checks

EPSS 1.0%CVSS 9.9
critical.is priorityof 100
42
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 61.6.616 × 2012.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8.

Affected

ProductAffectedFixed inSource
cal.com< 5.9.8–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/calcom/cal.com/security/advisories/GHSA-9r3w-4j8q-pw98