CVE-2023-37919: Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When…

PriorityP427medium5.4CVSS 3.1

AVNACLPRLUINSUCLILAN

EPSS

0.26%

17.7th percentile

Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner's identity. As of time of publication, no known patches or workarounds exist.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
cal	cal.com	<= 3.1.4	—
calcom	cal.com	<= 3.1.4	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.