CVE-2025-66489

Cal.com Authentication Bypass via bad TOTP + password checks

State: Published
Severity: 9.9 Critical
Published: Dec 3, 2025
Updated: Dec 3, 2025
Reserved: Dec 2, 2025

Description

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8.

Scores

CVSS	Score	Vector	Source
4.0	9.9 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N	GitHub_M

Weaknesses

CWE-303 Incorrect Implementation of Authentication Algorithm

Affected Products

Product	Versions
cal.comcalcom	< 5.9.8Affected

References

https://github.com/calcom/cal.com/security/advisories/GHSA-9r3w-4j8q-pw98

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.