CVE-2025-66489 is a critical (CVSS 9.8) authentication bypass in the Cal.com credentials provider. When a TOTP code is supplied, the password check is skipped, which can give access to accounts. Versions before 5.9.8 are affected, and 5.9.8 fixes it. This matters most for self-hosted installs.
What's affected
- Product: Cal.com, open source scheduling software (the advisory repository is listed as cal.diy).
- Affected: 5.9.7 and earlier.
- Fixed: 5.9.8.
- Location: the authorize function in the credentials provider, in packages/features/auth/lib/next-auth-options.ts, according to the advisory.
The record and the advisory agree on a critical rating. The advisory describes two scenarios. For users without two factor authentication, a non-empty TOTP field skips the password check. For users with two factor enabled, the password check is skipped even though the code is validated, which weakens the two factor setup.
How to check if you're exposed
If you self-host Cal.com, check the version in your deployment.
grep '"version"' package.json
docker ps --format "table {{.Names}}\t{{.Image}}"
If it is 5.9.7 or lower, you are affected. If you use the hosted service from the vendor, the fix is on their side; check their status or security notes. Also review sign in logs for successful logins that include a TOTP value on accounts that do not use two factor.
What to do now
- Upgrade self-hosted Cal.com to 5.9.8 or later.
- Review authentication logs for the period you ran an affected version, looking for logins on accounts without two factor that nevertheless involved a TOTP value.
- Reset sessions and consider forcing password resets for administrator and owner accounts if you see anything odd.
- Review connected calendars and API keys for accounts you cannot verify.
- Add the app and its Node dependencies to a regular scan. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The advisory describes problematic conditional logic. The code verified the password only when a TOTP code was absent, so adding a code turned the password check off. The record tags it CWE-303, which covers improper verification of the authentication factors. In plain words, the order and shape of an if statement meant a user could pick which checks to face.
Authentication code deserves the strictest tests, because a single inverted condition removes the whole control. Scheduling tools hold calendars and connected accounts, so account takeover has downstream effects. The record does not list exploitation in the wild, and the CVE is not on CISA KEV.
Quick check
Does this affect accounts that have two factor turned on?
Yes, in a weaker way. The advisory says the password check was skipped even for those users, leaving the code as the only factor.
Which version fixes it?
5.9.8.
Sources
Last reviewed: 18 October 2026.
