CVE-2026-63768: calcom cal.diy Open Redirect
Vulnerability summary
CVE-2026-63768 is a medium (CVSS 5.3) Open Redirect vulnerability in calcom cal.diy. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 20-07-2026PublishedVulnerability first disclosed.
- 17-09-2026Last modifiedVulnerability information updated.
Description
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.
CVSS metrics
4 scores · 2 sources · 2 versions- NVDNIST5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
0.00 pp
From 0.34% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCal.Diy
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Calcom1 product
- cal.diy≤ 6.2.0
1 vendor · 1 product