CVE-2026-63768 in cal.diy
Summary
by MITRE • 07/20/2026
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
The cal.diy platform version 6.2.0 and earlier contains a critical open redirect vulnerability within its conferencing OAuth callback endpoint that presents significant security risks for organizations relying on the system for video conferencing and collaboration services. This vulnerability stems from improper validation of the state parameter and onErrorReturnTo field in the OAuth authentication flow, creating an avenue for attackers to manipulate the redirection behavior during the authentication process.
The technical flaw manifests through the use of an unsigned state parameter that should normally contain a cryptographic signature to verify the integrity of the authentication request. When this parameter lacks proper validation or signing mechanisms, attackers can craft malicious state values that contain URLs pointing to attacker-controlled domains. The vulnerability extends beyond simple redirection by leveraging the onErrorReturnTo field which is designed to handle error conditions during OAuth flows but becomes exploitable when not properly sanitized or validated.
This open redirect vulnerability operates at the application layer and directly impacts user trust and security within the conferencing ecosystem. When users initiate a conference call through the platform, they are redirected through an OAuth authentication flow that typically involves redirection to a trusted domain first, then to the actual conferencing service. The malicious state parameter allows attackers to intercept this flow and redirect users to phishing sites or malicious domains before or during their authentication process, potentially capturing credentials or other sensitive information.
The operational impact of this vulnerability extends beyond simple phishing attacks as it can be leveraged in sophisticated social engineering campaigns targeting enterprise users. Attackers can craft convincing redirects that appear legitimate to end users, especially when the initial redirect occurs from a trusted cal.diy domain. This creates a dangerous situation where users may unknowingly navigate to malicious sites without recognizing the redirection has occurred. The vulnerability affects the entire authentication flow and could potentially be combined with other techniques such as session hijacking or man-in-the-middle attacks to further compromise user accounts.
Organizations using cal.diy versions 6.2.0 and earlier should implement immediate mitigations including proper validation of all state parameters, implementation of cryptographic signatures for state values, and strict sanitization of redirect URLs in the onErrorReturnTo field. The vulnerability aligns with CWE-601 Open Redirect weakness category which specifically addresses insecure redirection mechanisms in web applications. From an attack perspective, this vulnerability maps to several ATT&CK techniques including initial access through phishing campaigns and credential access via credential harvesting. Security teams should also consider implementing web application firewalls with rule sets that can detect and block suspicious redirect patterns, while monitoring for unauthorized redirection attempts in their network traffic logs.
The root cause of this vulnerability highlights a fundamental security principle regarding the handling of user-controllable input in authentication flows. Proper implementation of OAuth 2.0 standards requires that state parameters be cryptographically signed or validated to prevent tampering, and all redirect URLs should undergo strict validation against a whitelist of approved domains. The absence of these security controls creates an exploitable condition that directly violates secure coding practices recommended by organizations such as OWASP and NIST for preventing authentication-related vulnerabilities in web applications.