External risk intelligence

Cal.com Authentication Bypass Vulnerability Allows Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-66489

Cal.com is scheduling software designed to be internet-facing for public or client use. It operates as a web application where user login portals are routinely exposed to the public internet to facilitate booking and management, making the authentication surface directly reachable by design.

Cal Com

before 5.9.8

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts open-source scheduling software, specifically in its authentication process. A flaw allows bypassing password verification under certain conditions, which could lead to unauthorized access to user accounts. The main concern is to confirm if this scheduling software is in use and if affected versions are deployed.

Login bypass allows unauthorized account access.
It affects widely used scheduling software.
Confirm relevance and exposure of this software.

Attack Path

How an attacker could exploit the issue

An attacker could begin by interacting with the public login page of the Cal.com scheduling software. By submitting a crafted login attempt that includes a Time-based One-Time Password (TOTP) code, an attacker may bypass the standard password verification. This would allow them to gain unauthorized access to a user's account, potentially leading to account takeover.

No prior access needed.
Bypass password verification during login.
Unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

An attacker could gain unauthorized access to user accounts by bypassing password verification when a TOTP code is provided. This could occur when the TOTP code field is present, regardless of whether the user has Two-Factor Authentication enabled or not, due to flawed conditional logic in the authentication flow. This bypass could expose user accounts to unauthorized access and potential compromise.

User account access at risk.
Attacker bypasses password verification.
Unauthorized access to accounts.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Cal.com application owners and platform teams are likely responsible for addressing this vulnerability, as it affects the authentication flow of their scheduling software. The first practical step is to identify all instances of Cal.com, confirm their exposure and criticality, and then coordinate remediation with the appropriate product or platform owner.

Cal.com product owners should lead remediation.
Verify all Cal.com instances are identified.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cal.com?

Cal.com is an open-source platform used for scheduling meetings and managing appointments. It acts as a digital infrastructure for professionals and teams to coordinate availability, often functioning as a self-hosted or cloud-based web application that connects with various calendars to automate bookings.

What does CVE-2025-66489 mean for security?

This vulnerability is an authentication bypass, categorized as CWE-303 (Incorrect Implementation of Authentication). It means the software's logic incorrectly handles login verification. Specifically, if a user provides a TOTP code during the login process, the system may skip checking the primary password, allowing unauthorized access.

How does an attacker trigger this login bypass?

An attacker triggers the flaw by submitting a login request that includes a Time-based One-Time Password (TOTP) code. The vulnerability occurs because of flawed conditional logic in the authentication flow. It is important to note that this bypass can occur even if the target user has not actually enabled two-factor authentication, provided the input field for the code is present.

Is my instance of Cal.com at risk?

According to Halo Surface Signal, Cal.com is designed to be internet-facing to allow public scheduling, meaning the login portal is typically reachable from the public internet. If your instance is running a version prior to 5.9.8, the authentication surface is directly accessible to any attacker on the internet, increasing the relevance of this issue.

What is the first step to secure my system?

The primary action is to identify all deployed instances of Cal.com within your environment. Once you have an inventory of these applications, coordinate with the platform owners to update the software to version 5.9.8 or later, which contains the corrected authentication logic.

References

github.com/calcom/cal.com/security/advisories/GHSA-9r3w-4j8q-pw98

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.