2024 Cal.com — auth bypass, millions of bookings, account takeover
Data compromised
Meeting metadata; attendee PII; billing data; account takeover
Technical writeup
Critical access control flaws: auth bypass via org invite tokens allowed hijacking any account with email + token. IDOR exposed booking data platform-wide. JWT callback bug (CVE-2026-23478) enabled token forgery. Patched in 6.0.7/6.0.8.
Root cause
Broken access control; logic errors; IDOR