Vulnerability · Published Dec 3, 2025 · Assigned by GitHub_M

CVE-2025-66489Cal.com Authentication Bypass via bad TOTP + password checks

Critical 9.9

In plain English

A critical-severity security flaw in cal.com from calcom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 4.0)9.9Critical

Exploit odds (30 days)1.0%top 38.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8.

Affected products (as reported)

Vendor	Product	Versions
calcom	cal.com	< 5.9.8

Weakness: CWE-303 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

References

https://github.com/calcom/cal.com/security/advisories/GHSA-9r3w-4j8q-pw98 x_refsource_CONFIRM