CVE-2026-63768: cal.diy Open Redirect Vulnerability

CVE-2026-63768 Overview

CVE-2026-63768 is an open redirect vulnerability in cal.diy through version 6.2.0. The flaw exists in the conferencing OAuth callback endpoint, which fails to validate the state parameter cryptographically. Attackers can craft malicious state values containing an onErrorReturnTo field pointing to attacker-controlled URLs. When a victim initiates the OAuth flow, the application silently redirects them from the trusted cal.diy domain to the attacker's destination. This vector is well-suited for phishing campaigns because the initial URL displays the legitimate cal.diy origin. The vulnerability is tracked under CWE-601: URL Redirection to Untrusted Site.

Critical Impact
Attackers can leverage the trusted cal.diy domain to redirect users to phishing pages or malware delivery sites without user interaction beyond clicking a crafted OAuth link.

Affected Products

cal.diy versions up to and including 6.2.0
Conferencing OAuth callback endpoint
Deployments exposing the unsigned state parameter handler

Discovery Timeline

2026-07-20 - CVE-2026-63768 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63768

Vulnerability Analysis

The conferencing OAuth callback endpoint in cal.diy accepts a state parameter that is neither signed nor integrity-checked. The parameter carries an onErrorReturnTo field intended to control post-error navigation. Because the server trusts the value without validating that the destination belongs to an allowlist, any attacker-supplied URL is honored. The attack requires user interaction, typically a single click on a crafted link, but no authentication.

Once the callback fires with the malicious state, the application issues a redirect response pointing to the attacker's URL. The victim's browser follows the redirect from the cal.diy origin, which increases the perceived legitimacy of the destination page. Phishing kits can pair this with cloned login screens to harvest credentials or OAuth tokens.

Root Cause

The root cause is missing cryptographic integrity protection on the OAuth state parameter. Standard OAuth 2.0 guidance requires state to be opaque and bound to the user session for CSRF protection. cal.diy instead stored an editable onErrorReturnTo field inside the parameter and used it directly as a redirect target without allowlist validation.

Attack Vector

Exploitation is remote and requires no privileges. An attacker constructs a URL to the cal.diy OAuth callback with a crafted state payload containing onErrorReturnTo set to an attacker-controlled domain. The attacker then distributes the link through email, chat, or social media. When a target clicks the link and the OAuth flow triggers the error path, cal.diy redirects the browser to the attacker's site. Refer to the VulnCheck Security Advisory and the GitHub Issue Report for the disclosed request structure.

Detection Methods for CVE-2026-63768

Indicators of Compromise

HTTP requests to the cal.diy conferencing OAuth callback containing onErrorReturnTo values pointing to external domains
Referer chains showing users leaving cal.diy immediately after an OAuth callback request
Unusual state parameter payloads that decode to JSON containing redirect fields

Detection Strategies

Inspect web server and reverse proxy logs for OAuth callback requests where the decoded state parameter references domains outside your organization's allowlist
Alert on 302 responses from the callback endpoint whose Location header points to non-cal.diy hosts
Correlate email gateway telemetry with click-through events landing on the cal.diy OAuth callback path

Monitoring Recommendations

Enable verbose logging on the OAuth callback route to capture full query strings and redirect targets
Feed web proxy and email security logs into a centralized analytics pipeline to identify phishing lures that abuse the callback URL
Track outbound redirects from trusted internal domains and flag any that resolve to newly registered or low-reputation hosts

How to Mitigate CVE-2026-63768

Immediate Actions Required

Upgrade cal.diy beyond version 6.2.0 once the fix from GitHub Pull Request #29681 is included in a released build
Restrict OAuth callback redirects to an explicit allowlist of internal paths and reject absolute URLs to external hosts
Sign or HMAC-protect the state parameter so tampering with onErrorReturnTo invalidates the request

Patch Information

The upstream fix is tracked in GitHub Pull Request #29681 against the GitHub Issue Report #29679. Administrators should monitor the cal.diy release notes and apply the version that incorporates the signed-state validation logic. Additional context is available in the VulnCheck Security Advisory.

Workarounds

Deploy a reverse proxy rule that strips or validates onErrorReturnTo fields on requests to the OAuth callback endpoint
Enforce a Content Security Policy and browser-level warnings that surface cross-origin redirects to end users
Educate users about OAuth phishing patterns and require security awareness training before enabling conferencing integrations

bash

# Example NGINX rule to block external redirect targets on the OAuth callback
location /api/auth/callback/conferencing {
    if ($arg_state ~* "onErrorReturnTo=https?%3A%2F%2F(?!cal\.diy)") {
        return 400;
    }
    proxy_pass http://cal_diy_backend;
}