Medium
cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
Type: advisorySources: OSV
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-63768
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 16:14 UTC · Revision 1
Source evidence
cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State
core-osv · Original sourcePublished 20 Jul 2026, 19:08 UTC
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.
osv:CVE-2026-63768
Complete source record
{
"id": "502aa2c60e9d7688f8759a961c3e64ba99a8f2e471262d5e9b1b390e1bba120d",
"url": "https://osv.dev/vulnerability/CVE-2026-63768",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State",
"summary": "cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.",
"evidence": "osv:CVE-2026-63768",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-63768",
"aliases": [
"CVE-2026-63768"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/calcom/cal.diy",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1c193cca8682b33b9866c792186033f7ef886682"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "6.2.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "6.2.0"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"v6.2.0",
"v6.1.16",
"v6.1.15",
"v6.1.14",
"v6.1.13",
"v6.1.12",
"v6.1.11",
"v6.1.10",
"v6.1.9",
"v6.1.8",
"v6.1.7",
"v6.1.6",
"v6.1.5",
"v6.1.4",
"v6.1.3",
"v6.1.2",
"v6.1.1",
"v6.1.0",
"v6.0.13",
"v6.0.12",
"v6.0.11",
"v6.0.10",
"v6.0.9",
"v6.0.8",
"v6.0.7",
"v6.0.6",
"v6.0.5",
"v6.0.4",
"v6.0.3",
"v6.0.2",
"v6.0.1",
"v6.0.0",
"v5.9.15",
"v5.9.14",
"v5.9.13",
"v5.9.12",
"v5.9.11",
"v5.9.10",
"v5.9.9",
"v5.9.8",
"v5.9.7",
"v5.9.6",
"v5.9.5",
"v5.9.4",
"v5.9.3",
"v5.9.2",
"v5.9.1",
"v5.9.0",
"v5.8.14",
"v5.8.13",
"v5.8.12",
"v5.8.11",
"v5.8.10",
"v5.8.9",
"v5.8.8",
"@calcom/atoms@1.12.1",
"v5.8.7",
"v5.8.6",
"v5.8.5",
"v5.8.4",
"v5.8.3",
"@calcom/atoms@1.11.0",
"v5.8.1",
"v5.8.0",
"v5.7.12",
"v5.7.11",
"v5.7.10",
"v5.7.8",
"v5.7.9",
"v5.7.7",
"v5.7.6",
"@calcom/atoms@1.10.0",
"v5.7.5",
"v5.7.4",
"v5.7.3",
"@calcom/atoms@1.9.0",
"v5.7.2",
"v5.7.1",
"v5.7.0",
"v5.6.20",
"v5.6.19",
"v5.6.18",
"v5.6.17",
"@calcom/atoms@1.8.0",
"v5.6.16",
"v5.6.15",
"@calcom/atoms@1.7.1",
"v5.6.14",
"v5.6.13",
"v5.6.12",
"@calcom/atoms@1.7.0",
"v5.6.11",
"v5.6.10",
"v5.6.9",
"v5.6.8",
"v5.6.7",
"v5.6.6",
"v5.6.5",
"@calcom/atoms@1.6.0",
"v5.6.4",
"v5.6.3",
"@calcom/atoms@1.5.0",
"v5.6.2",
"v5.6.1",
"v5.6.0",
"@calcom/atoms@1.4.0",
"v5.5.18",
"@calcom/atoms@1.3.1",
"@calcom/atoms@1.3.0",
"v5.5.17",
"v5.5.16",
"v5.5.15",
"v5.5.14",
"v5.5.13",
"v5.5.12",
"v5.5.11",
"@calcom/atoms@1.2.0",
"@calcom/atoms@1.1.2",
"v5.5.10",
"v5.5.9",
"v5.5.8",
"v5.5.7",
"v5.5.6",
"v5.5.5",
"v5.5.4",
"v5.5.3",
"v5.5.2",
"v5.5.1",
"v5.5.0",
"v5.4.20",
"@calcom/atoms@1.1.0",
"v5.4.19",
"v5.4.17",
"v5.4.16",
"v5.4.15",
"v5.4.14",
"v5.4.13",
"v5.4.12",
"v5.4.11",
"v5.4.10",
"@calcom/atoms@1.0.114",
"@calcom/atoms@1.0.112",
"@calcom/atoms@1.0.110",
"v5.4.9",
"v5.4.8",
"v5.4.7",
"v5.4.6",
"v5.4.5",
"v5.4.4",
"v5.4.3",
"v5.4.2",
"v5.4.1",
"v5.4.0",
"v5.3.13",
"v5.3.12",
"v5.3.11",
"v5.3.10",
"v5.3.9",
"v5.3.8",
"v5.3.7",
"v5.3.6",
"v5.3.5",
"v5.3.4",
"v5.3.3",
"v5.3.2",
"v5.3.1",
"v5.3.0",
"v5.2.17",
"v5.2.16",
"v5.2.15",
"v5.2.14",
"v5.2.13",
"v5.2.12",
"v5.2.10",
"v5.2.11",
"v5.2.9",
"v5.2.8",
"v5.2.7",
"v5.2.6",
"v5.2.5",
"v5.2.4",
"v5.2.3",
"v5.2.2",
"v5.2.1",
"v5.2.0",
"v5.1.21",
"v5.1.20",
"v5.1.19",
"v5.1.18",
"v5.1.17",
"v5.1.16",
"v5.1.15",
"v5.1.14",
"v5.1.13",
"v5.1.12",
"v5.1.11",
"v5.1.10",
"v5.1.9",
"v5.1.8",
"v5.1.7",
"v5.1.6",
"v5.1.5",
"v5.1.4",
"v5.1.3",
"v5.1.2",
"v5.1.1",
"v5.1.0",
"v5.0.20",
"v5.0.19",
"v5.0.18",
"v5.0.17",
"v5.0.15",
"v5.0.14",
"v5.0.13",
"v5.0.12",
"v5.0.11",
"v5.0.10",
"v5.0.9",
"v5.0.8",
"v5.0.6",
"v5.0.7",
"v5.0.5",
"v5.0.4",
"v5.0.3",
"v5.0.2",
"v5.0.1",
"v5.0.0",
"v4.9.13",
"v4.9.12",
"v4.9.11",
"v4.9.10",
"v4.9.9",
"v4.9.8",
"v4.9.7",
"v4.9.6",
"v4.9.5",
"v4.9.4",
"v4.9.3",
"v4.9.2",
"v4.9.1",
"v4.9.1-rc1",
"v4.9.0",
"v4.8.19",
"v4.8.18",
"v4.8.16",
"v4.8.15",
"v4.8.14",
"v4.8.13",
"v4.8.12",
"v4.8.11",
"v4.8.10",
"v4.8.9",
"v4.8.8",
"v4.8.7",
"v4.8.6",
"v4.8.5",
"v4.8.4",
"v4.8.3",
"v4.8.2",
"v4.8.1",
"v4.8.0",
"v4.7.25",
"v4.7.24",
"v4.7.23",
"v4.7.22",
"v4.7.21",
"v4.7.20",
"v4.7.19",
"v4.7.18",
"v4.7.17",
"v4.7.16",
"v4.7.15",
"v4.7.14",
"v4.7.13",
"v4.7.12",
"v4.7.11",
"v4.7.10",
"v4.7.9",
"v4.7.8",
"v4.7.7",
"v4.7.6",
"v4.7.5",
"v4.7.4",
"v4.7.3",
"v4.7.2",
"v4.7.1",
"v4.7.0",
"v4.6.24",
"v4.6.23",
"v4.6.22",
"v4.6.21",
"v4.6.20",
"v4.6.19",
"v4.6.18",
"v4.6.17",
"v4.6.16",
"v4.6.15",
"v4.6.14",
"v4.6.13",
"v4.6.12",
"v4.6.11",
"v4.6.10",
"v4.6.9",
"v4.6.8",
"v4.6.7",
"v4.6.6",
"v4.6.5",
"v4.6.4",
"v4.6.3",
"v4.6.2",
"v4.6.1",
"v4.6.0",
"v4.5.11",
"v4.5.10",
"v4.5.9",
"v4.5.8",
"v4.5.7",
"v4.5.6",
"v4.5.5",
"v4.5.4",
"v4.5.3",
"v4.5.2",
"v4.5.1",
"v4.5.0",
"v4.4.9",
"v4.4.8",
"v4.4.7",
"v4.4.6",
"v4.4.5",
"v4.4.4",
"v4.4.3",
"v4.4.2",
"v4.4.1",
"v4.4.0",
"v4.3.6",
"v4.3.5",
"v4.3.4",
"v4.3.3",
"v4.3.2",
"v4.3.1",
"v4.3.0",
"v4.2.5",
"v4.2.4",
"v4.2.3",
"v4.2.2",
"v4.2.1",
"v4.2.0",
"v4.1.12",
"v4.1.11",
"v4.1.10",
"v4.1.9",
"v4.1.8",
"v4.1.7",
"v4.1.6",
"v4.1.5",
"v4.1.4",
"v4.1.3",
"v4.1.2",
"v4.1.1",
"v4.1.0",
"v4.0.9",
"v4.0.8",
"v4.0.7",
"v4.0.6",
"v4.0.5",
"v4.0.4",
"v4.0.3",
"v4.0.2",
"v4.0.1",
"v4.0.0",
"v3.9.9",
"v3.9.8",
"v3.9.7",
"v3.9.6",
"v3.9.5",
"v3.9.4",
"v3.9.3",
"v3.9.2",
"v3.9.1",
"v3.9.0",
"v3.8.9",
"v3.8.8",
"v3.8.7",
"v3.8.6",
"v3.8.5",
"v3.8.4",
"v3.8.3",
"v3.8.2",
"v3.8.1",
"v3.8.0",
"v3.8.0-rc1",
"v3.7.19",
"v3.7.18",
"v3.7.17",
"v3.7.16",
"v3.7.15",
"v3.7.14",
"v3.7.13",
"v3.7.12",
"v3.7.11",
"v3.7.10",
"v3.7.9",
"v3.7.8",
"v3.7.7",
"v3.7.6",
"v3.7.5",
"v3.7.4",
"v3.7.3",
"v3.7.2",
"v3.7.1",
"v3.7.0",
"v3.6.4",
"v3.6.3",
"v3.6.2",
"v3.6.1",
"v3.6.0",
"v3.5.5",
"v3.5.4",
"v3.5.3",
"v3.5.2",
"v3.5.1",
"v3.5.0",
"v3.4.10",
"v3.4.9",
"v3.4.8",
"v3.4.7",
"v3.4.6",
"v3.4.5",
"v3.4.4",
"v3.4.4-rc1",
"v3.4.3",
"v3.4.2",
"v3.4.1",
"v3.4.0-rc1",
"v3.4.0",
"v3.3.7",
"v3.3.6",
"v3.3.5",
"v3.3.4",
"v3.3.3",
"v3.3.2",
"v3.3.1",
"v3.3.0",
"v3.2.10",
"v3.2.9",
"v3.2.8",
"v3.2.7.1",
"v3.2.7",
"v3.2.6",
"v3.2.5",
"v3.2.4",
"v3.2.3",
"v3.2.2",
"v3.2.1",
"v3.2.0",
"v3.1.9",
"v3.1.8",
"v3.1.7",
"v3.1.6",
"v3.1.5",
"v3.1.4",
"v3.1.3",
"v3.1.2",
"v3.1.1",
"v3.1.0",
"v3.0.16",
"v3.0.15",
"v3.0.14",
"v3.0.13",
"v3.0.12",
"v3.0.11",
"v3.0.10",
"v3.0.9",
"v3.0.8",
"v3.0.7",
"v3.0.6",
"v3.0.5",
"v3.0.4",
"v3.0.3",
"v3.0.2",
"v3.0.1",
"v3.0.0.2",
"v3.0.0.1",
"v3.0.0",
"v2.9.8",
"v2.7.9",
"v2.9.6",
"v2.9.5.1",
"v2.9.5",
"v2.8.1",
"v2.8.0",
"v2.7.18",
"v2.7.17",
"v2.7.16",
"v2.7.15",
"v2.7.14",
"v2.7.13",
"v2.7.12",
"v2.7.11",
"v.2.7.10",
"v2.7.8",
"v2.7.7",
"v2.7.6",
"v2.7.5",
"v.2.7.4",
"v2.7.3",
"v2.7.1",
"v2.7.0",
"v2.6.12",
"v2.6.11",
"v2.6.10",
"v2.6.9",
"v2.6.8",
"v2.6.7",
"v2.6.6",
"v2.6.5",
"v2.6.4",
"v2.6.3",
"v2.6.2",
"v2.6.1",
"v2.6.0",
"v2.5.15",
"v2.5.14",
"v2.5.13",
"v2.5.12",
"v2.5.11",
"v2.5.10",
"v2.5.9",
"v2.5.8",
"v2.5.7",
"v2.5.6",
"v2.5.5",
"v.2.5.4",
"v2.5.3",
"v.2.5.2",
"v.2.5.1",
"v2.5.0",
"v2.4.7",
"v2.4.6",
"v2.4.4",
"v2.4.3",
"v2.4.2",
"v2.4.1",
"v2.4.0",
"v2.3.8",
"v2.3.7",
"v2.3.6",
"v2.3.5",
"v2.3.4",
"v2.3.3",
"v2.3.2",
"v2.3.1",
"v2.3.0",
"v2.2.2",
"v2.2.1",
"v2.2.0",
"v2.1.5",
"v2.1.4",
"v2.1.3",
"v2.1.2",
"v2.1.1",
"v2.1.0",
"v2.0.5",
"v2.0.4",
"v2.0.3",
"v2.0.2",
"v2.0.1",
"v2.0.0",
"v1.9.5",
"v1.9.4",
"v1.9.3",
"v1.9.2",
"v1.9.1",
"v1.9.0",
"v1.8.5",
"v1.8.4",
"v1.8.3",
"v1.8.2",
"v1.8.1",
"v1.8.0",
"v1.7.7",
"v1.7.6",
"v1.7.5",
"v1.7.4",
"v1.7.3",
"v1.7.2",
"v1.7.1",
"v1.7.0",
"v1.6.3",
"v1.6.2",
"v.1.6.2",
"v1.6.1",
"v1.6",
"v.1.5.4",
"V1.5.3",
"V1.5",
"v1.4",
"v1.3",
"v1.2",
"v1.1",
"v1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63768.json"
}
}
],
"modified": "2026-10-28T02:30:30.083301446Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63768.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-63768",
"https://www.vulncheck.com/advisories/cal-diy-conferencing-oauth-callback-open-redirect-via-unsigned-state",
"https://github.com/calcom/cal.diy/issues/29679",
"https://github.com/calcom/cal.diy/pull/29681",
"https://github.com/calcom/cal.diy"
],
"provider_metadata": {
"cwe_ids": [
"CWE-601"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63768.json"
}
},
"related_cves": [
{
"value": "CVE-2026-63768",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 497212,
"published_at": "2026-07-20T19:08:21.751+00:00"
}