CVE-2025-66489

CVE-2025-66489 is an authentication bypass vulnerability affecting Cal.com, an open-source scheduling software. The vulnerability exists in versions prior to 5.9.8. It stems from a flaw in the login credentials provider that allows attackers to bypass password verification when a Time-based One-Time Password (TOTP) code is provided. This is due to problematic conditional logic in the authentication flow within the authorize() function. The vulnerability can be exploited in two scenarios. In the first, attackers can bypass both password and TOTP verification by submitting any non-empty value in the totpCode field along with the victim's email address. In the second scenario, users with 2FA enabled are also affected, as the system ignores the password even when validating the TOTP code. Cal.com version 5.9.8 addresses this vulnerability.