Vulnerability · Published Jul 20, 2026 · Assigned by VulnCheck

CVE-2026-63768cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

Medium 4.3

In plain English

A medium-severity open redirect in cal.diy from calcom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 72.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.

Affected products (as reported)

Vendor	Product	Versions
calcom	cal.diy	0 – through 6.2.0

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

Researcher Disclosure technical-description, exploit, issue-tracking
Pull Request issue-tracking, patch
https://www.vulncheck.com/advisories/cal-diy-conferencing-oauth-callback-open-redirect-via-unsigned-state third-party-advisory