CVE-2026-63768
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Jul 20, 2026
CISA due date
—
The record
cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field to silently redirect visitors from the trusted domain to attacker-controlled URLs for phishing attacks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-107020 An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader… CWE-601
- CVE-2026-118425 A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an… CWE-601
- CVE-2026-118656 Echo is a Go web framework. CWE-601
- CVE-2026-118658 Echo is a Go web framework. CWE-601
- CVE-2026-111031 The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied… CWE-601
- CVE-2026-117553 Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that… CWE-601
- CVE-2026-116578 Tornado is a Python web framework and asynchronous networking library. CWE-601
- CVE-2026-115537 A weakness has been identified in gedelumbung HospitalManagement up to… CWE-601