CVE-2025-66489CWE-303

CVE-2025-66489

Critical · published December 4, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
57.5
In the wild
Unconfirmed
What it is

Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00842 · 57.5th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2025-12-04T01:16Z
Affected products (1)
ProductVersionsFixed in
cal/cal.com< 5.9.85.9.8
References (1)
https://github.com/calcom/cal.com/security/advisories/GHSA-9r3w-4j8q-pw98 · [email protected]
EPSS history
Timeline
  • 03 DEC 19:44Z
    Cal.com Authentication Bypass via bad TOTP + password checks
    cvelistv5