Authentication Bypass in Cal.com login credentials provider

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-66489, a critical authentication bypass vulnerability in Cal.com (versions <= 5.9.7). The exploit is implemented in a single Python script (CVE-2025-66489.py) and is accompanied by a detailed README.md explaining the vulnerability, affected versions, and usage instructions. The exploit works by sending a crafted POST request to the /api/auth/callback/credentials endpoint with a valid email, an incorrect password, and any TOTP code, exploiting a logic flaw where the presence of a TOTP code causes the backend to skip password verification. If successful, the script establishes a valid session and demonstrates access to protected resources (e.g., /dashboard). The README provides clear guidance for setup, execution, and expected results, and emphasizes the criticality of the issue and the need for immediate patching. No hardcoded endpoints or credentials are present; the script is parameterized for flexible targeting. The exploit is a functional PoC and not a detection script or fake exploit.

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-66489, a critical authentication bypass vulnerability in Cal.com (versions <= 5.9.7). The exploit is implemented in a single Python script (CVE-2025-66489.py) and is accompanied by a detailed README.md explaining the vulnerability, affected versions, exploitation steps, and remediation advice. The exploit works by sending a crafted POST request to the /api/auth/callback/credentials endpoint of a vulnerable Cal.com instance, supplying a valid email, any (incorrect) password, a dummy TOTP code, and a valid CSRF token. Due to a logic flaw, the presence of a TOTP code causes the backend to skip password verification, allowing an attacker to log in as any user with a known email address, even if 2FA is enabled. Upon successful exploitation, the script confirms access to the /dashboard endpoint and outputs the session cookie, which can be used to access the application as the compromised user. The repository is structured simply, with the main exploit logic in the Python script and comprehensive usage and background information in the README. No hardcoded endpoints or credentials are present; the script requires user-supplied parameters. The attack vector is remote (network-based), and the exploit is classified as a PoC, as it demonstrates the vulnerability but does not include weaponized or automated post-exploitation features.