Cal.com NextAuth JWT Session Update Authentication Bypass (CVE-2026-23478)

A critical authentication bypass in the Cal.com open-source scheduling platform allows remote attackers to hijack arbitrary user accounts by abusing a flaw in a custom NextAuth JWT callback used during session updates. Tracked as CVE-2026-23478 (reported as CVSS 10.0), the issue affects Cal.com versions >= 3.1.6 and < 6.0.7 and is exploitable over the network with minimal prerequisites—primarily knowledge of a victim’s email address.

The weakness occurs when the session trigger is set to "update", where Cal.com improperly accepts client-controlled identity fields and writes them into the JWT without server-side validation (mapped to issues such as CWE-602 and CWE-639). An attacker can send a single API call like session.update({ email: "victim@example.com" }) to produce a manipulated token that retains the attacker’s sub but swaps in the victim’s email; subsequent requests are treated as the victim because the application looks up users using the attacker-controlled token.email field. Successful exploitation yields full access to victim data and capabilities (bookings, event types, integrations, org membership, billing, and potentially admin privileges), and 2FA/external IdP associations do not mitigate because the compromise occurs at the session token level; Cal.com 6.0.7+ is cited as containing the fix.