CVE-2026-63768

MEDIUM

cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

Title source: cna

Description

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.

References (3)

Core 3

Core References

Exploit technical-description exploit issue-tracking

Researcher Disclosure

https://github.com/calcom/cal.diy/issues/29679

Issue Tracking issue-tracking patch

Pull Request

https://github.com/calcom/cal.diy/pull/29681

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/cal-diy-conferencing-oauth-callback-open-redirect-via-unsigned-state

Scores

CVSS v3 4.3

EPSS 0.0020

EPSS Percentile 9.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-601

Status published

Products (1)

calcom/cal.diy < 6.2.0

Published Jul 20, 2026

Tracked Since Jul 21, 2026