The vulnerability resides in Cal.com's custom NextAuth JWT callback. An attacker can supply any email address to the session.update() function without validation, allowing them to assume the identity of any user. This bypasses authentication and grants full access to that account, enabling the attacker to view or modify confidential data, schedule appointments, and potentially impersonate the user in future interactions. The underlying weakness aligns with CWE‑602 and CWE‑639.

The flaw affects Cal.com versions ranging from 3.1.6 through 6.0.6. The open‑source scheduling platform is used by organizations relying on secure user authentication. Version 6.0.7 and later include the fix that validates the email prior to updating the session.

The CVSS score of 10 marks this as a critical flaw. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because no special conditions are required beyond sending a crafted request to the JWT callback, an attacker with network access could exploit the issue. The lack of input validation makes this a straightforward authentication bypass.