CVE-2023-37919: falha de média gravidade em calcom cal.com
Cal.com not expiring old sessions after enabling 2FA
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.3%
Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner's identity. As of time of publication, no known patches or workarounds exist.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
calcom · cal.comCVEs relacionadas — calcom cal.com
No mesmo produto, das mais perigosas para as menos.
CVE-2025-66489CRITICALCal.com Authentication Bypass via bad TOTP + password checksEPSS 1.0%CVE-2026-23478CRITICALCal.com has an Authentication Bypass via Unvalidated Email in Custom JWT CallbackEPSS 0.5%CVE-2026-112043MEDIUMcalcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorizationEPSS 0.4%CVE-2026-109143MEDIUMcalcom cal.com/cal.diy Credentials delete credentials.delete privileges managementEPSS 0.2%