cal.diy provides a conferencing OAuth callback that accepts a state parameter without validation. An attacker can encode a malicious URL in this unsigned state and the onErrorReturnTo field, causing users who visit the callback from the trusted domain to be silently redirected to a site of the attacker’s choice. This flaw is identified as CWE‑601, a classic open‑redirect weakness that can be exploited without authentication to carry out phishing or other social engineering attacks.

The vulnerability affects calcom's cal.diy conferencing software up through version 6.2.0. Any installation of cal.diy that has not been updated beyond this release is potentially vulnerable, as the CVE entry does not provide a specific patch or version update at the time of analysis.

The CVSS score of 5.3 places this issue in the moderate risk range, while the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting limited evidence of real‑world attacks. The attack vector requires an attacker to craft a malicious OAuth callback URL that carries an unsigned state and an arbitrary onErrorReturnTo value. When a user follows this callback from the trusted domain, the user is secretly redirected to the attacker’s site, enabling phishing or other social engineering techniques. Given the low exploitation probability, the overall risk remains moderate, but the potential for targeted phishing persists.