CVE-2025-66511: Nextcloud Calendar Auth Bypass Flaw

CVE-2025-66511 Overview

CVE-2025-66511 is a predictable token generation vulnerability in the Nextcloud Calendar app affecting versions prior to 6.0.3. The Calendar app generates participant tokens for meeting proposals using a hash function rather than a cryptographically secure random source. An attacker can compute valid participant tokens, request meeting proposal details, and submit dates on behalf of participants. The issue is tracked under CWE-330: Use of Insufficiently Random Values and is fixed in Calendar 6.0.3.

Critical Impact
Attackers can forge valid participant tokens for meeting proposals, exposing scheduling data and allowing unauthorized submission of proposed dates without authentication.

Affected Products

Nextcloud Calendar versions prior to 6.0.3
Deployments exposing meeting proposal functionality to unauthenticated users
Nextcloud instances relying on participant tokens for proposal authorization

Discovery Timeline

2025-12-05 - CVE-2025-66511 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66511

Vulnerability Analysis

The Nextcloud Calendar app implements a meeting proposal workflow where participants receive links containing tokens used to view proposal details and submit their availability. These tokens serve as bearer credentials, granting access to proposal data without requiring an authenticated Nextcloud session.

In versions prior to 6.0.3, the app derived participant tokens from a hash function over predictable inputs rather than generating them from a cryptographically secure random number generator. Because the token space is deterministic given knowledge of the inputs, an attacker can reproduce the hash calculation and compute valid tokens for existing proposals.

With a computed token, an attacker can call the meeting proposal endpoints to retrieve details such as invited participants, proposed date options, and organizer metadata. The attacker can also submit date selections, corrupting the scheduling workflow and misleading organizers about participant availability.

Root Cause

The root cause is a violation of secure token generation principles. Tokens intended to act as unguessable capabilities were produced by hashing predictable values instead of drawing from a cryptographically secure pseudorandom number generator (CSPRNG). See the GitHub Security Advisory GHSA-whm3-vv55-gf27 for the vendor description.

Attack Vector

Exploitation is remote and requires no authentication or user interaction. An attacker who can enumerate or infer the inputs feeding the token hash reconstructs valid tokens offline, then submits authenticated-looking requests to the meeting proposal API endpoints. Details of the fix are available in the remediation commit and pull request #7659.

No public proof-of-concept exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.255%.

Detection Methods for CVE-2025-66511

Indicators of Compromise

Unexpected HTTP requests to Nextcloud Calendar meeting proposal endpoints containing tokens that do not correspond to invited participants.
High volumes of GET or POST requests to proposal URLs from single source IP addresses, suggesting token enumeration or brute-force reconstruction.
Meeting proposal responses submitted from IP addresses or user agents inconsistent with the invited participant's normal activity.

Detection Strategies

Review Nextcloud web server access logs for repeated requests to Calendar proposal routes with varying token values.
Correlate proposal submission events with organizer notifications to identify submissions from participants who did not receive an invitation.
Baseline normal proposal traffic per tenant and alert on deviations in request rate, source geography, or user agent diversity.

Monitoring Recommendations

Forward Nextcloud application and reverse proxy logs to a centralized log platform for retention and anomaly analysis.
Enable Nextcloud audit logging for the Calendar app to capture proposal access and submission events with participant identifiers.
Monitor the Nextcloud app store for future Calendar security releases and subscribe to the Nextcloud security advisories feed.

How to Mitigate CVE-2025-66511

Immediate Actions Required

Upgrade the Nextcloud Calendar app to version 6.0.3 or later through the Nextcloud app management interface.
Invalidate any outstanding meeting proposals created on vulnerable versions and reissue them after upgrading.
Audit recent proposal submissions to identify entries that may have been forged using predictable tokens.

Patch Information

The fix is available in Nextcloud Calendar 6.0.3. The remediation replaces the predictable hash-based token generation with cryptographically random tokens. Review the remediation commit 8de14ae and the associated HackerOne report #3385434 for technical context.

Workarounds

Disable the Calendar app on affected Nextcloud instances until the 6.0.3 upgrade is applied, if meeting proposals are in active use.
Restrict access to the Nextcloud Calendar proposal endpoints at the reverse proxy layer to trusted networks where feasible.
Instruct organizers to avoid creating new meeting proposals containing sensitive scheduling information until the app is patched.

bash

# Upgrade Nextcloud Calendar via occ CLI
sudo -u www-data php occ app:update calendar
sudo -u www-data php occ app:list | grep calendar

# Verify the installed version is 6.0.3 or higher