Medium severity · published Jul 25, 2023
CVE-2023-37919
Cal.com not expiring old sessions after enabling 2FA
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner's identity. As of time of publication, no known patches or workarounds exist.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
cal.com · calcom
<= 3.1.4 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37919
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37919
Vendor Advisory
https://github.com/calcom/cal.com/security/advisories/GHSA-cpf2-q635-xrwx
More from cal.com
9.8
CVE-2026-23478
Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback
9.8
CVE-2025-66489
Cal.com Authentication Bypass via bad TOTP + password checks
6.3
CVE-2026-112043
calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization
5.4
CVE-2026-109143
calcom cal.com/cal.diy Credentials delete credentials.delete privileges management