Critical · published January 13, 2026
🚨 Just a custom callback is all it takes to unlock any user’s account! An attacker can now step into someone else’s shoes by exploiting a flaw in Cal.com's NextAuth integration from version 3.1.6 to before 6.0.7. 🔥 Think of this like a restaurant where a waiter mistakenly assumes any name given is the one that ordered the food — just one slip and anyone can walk away with someone else's dinner! With this vulnerability, an attacker can gain full access to any account just by knowing the target's email address. This means they could change sensitive information, access personal data, or even make unauthorized bookings — it’s absolutely devastating!
Think of this like a restaurant where a waiter mistakenly assumes any name given is the one that ordered the food — just one slip and anyone can walk away with someone else's dinner! This flaw in the custom NextAuth JWT callback allows attackers to manipulate session updates, granting them unauthorized access to user accounts without proper authentication checks.
With this vulnerability, an attacker can gain full access to any account just by knowing the target's email address. This means they could change sensitive information, access personal data, or even make unauthorized bookings — it’s absolutely devastating! Upgrade to version 6.0.7 immediately to patch this vulnerability. Additionally, review your authentication flows to ensure robust checks are in place to prevent this kind of access in the future. This is fixable! Follow these steps, and you'll be back in control in no time. 🛡️