CVE-2026-63768

MediumCVSS 4.3

Published: 20/07/2026(UTC)Updated: 17/09/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

28th percentile - higher than 28% of all known CVEs

Summary

Vulnerability in cal.diy up to version 6.2.0. Open redirect in the conferencing OAuth callback endpoint. Attackers can redirect users to arbitrary URLs via a malicious state parameter.

Risk Assessment

Risk of phishing attacks by redirecting from a trusted domain to malicious sites.

Recommendation

Upgrade cal.diy to version above 6.2.0 or implement state parameter validation.

Other vulnerabilities in cal.diy

CVE-2026-9304Medium
A vulnerability was found in calcom cal.diy up to 4.9.4 in the validateUrlForSSRF function in the file apps/web/app/api/logo/route.ts of the Logo API component. Manipulation leads to server-side request forgery. The attack is remote but difficult to exploit. The exploit has been published. The vendor did not respond.

Original NVD description (English source)

cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS