CVE-2023-37919: fallo de gravedad media en calcom cal.com
Cal.com not expiring old sessions after enabling 2FA
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.3%
Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner's identity. As of time of publication, no known patches or workarounds exist.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Productos afectados
calcom · cal.comCVEs relacionadas — calcom cal.com
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-66489CRITICALCal.com Authentication Bypass via bad TOTP + password checksEPSS 1.0%CVE-2026-23478CRITICALCal.com has an Authentication Bypass via Unvalidated Email in Custom JWT CallbackEPSS 0.5%CVE-2026-112043MEDIUMcalcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorizationEPSS 0.4%CVE-2026-109143MEDIUMcalcom cal.com/cal.diy Credentials delete credentials.delete privileges managementEPSS 0.2%