# CVE-2026-9303: Cal.com cal.diy CSRF in Availability API and OAuth Callbacks

Source: https://junglewise.ai/threats/cve-2026-9303-cal-com-cal-diy-csrf-in-availability-api-and-oauth-callbacks  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-23. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-9303 · Severity: medium · CVSS 4.3 · Published 2026-05-23

A security vulnerability exists in Cal.com (cal.diy), an open-source scheduling platform. The flaw allows an attacker to trick a logged-in user into performing unintended actions, such as modifying their calendar availability or linking the attacker's third-party accounts (like Basecamp or Stripe) to the victim's profile. This can lead to unauthorized account access, data pollution, or a denial of service where the victim's scheduling availability is corrupted.

Technologies: [Cal.Com](https://junglewise.ai/threats/technologies/cal-com). Vendors: [Cal.com](https://junglewise.ai/threats/vendors/cal-com).

## Quick answers

**Is CVE-2026-9303 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9303 being exploited in the wild.

**How severe is CVE-2026-9303?** Medium severity, with a CVSS score of 4.3, published 23 May 2026.

**Which products and versions are affected?** Cal.Com up to 4.9.4.

**Is there a fix for CVE-2026-9303?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9303 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-9303?** Check whether you run Cal.Com at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities exist in Cal.com (cal.diy) up to version 4.9.4. The first issue resides in the Calendar Availability API (/api/availability/calendar), where the Next.js App Router fails to validate CSRF tokens and improperly processes 'text/plain' requests as JSON, bypassing CORS preflight checks. The second issue involves the OAuth callback handlers where a hardcoded allowlist (NONCE_EXEMPT_APPS) exempts specific integrations (Stripe, Basecamp3, Dub, Webex, Tandem) from nonce validation. Furthermore, these handlers commit OAuth token linkages to the database before verifying the state parameter. An unauthenticated remote attacker can exploit these flaws by inducing a victim with an active session to visit a malicious URL or execute a cross-origin fetch request, leading to unauthorized calendar mutation or account takeover via rogue integration linking.

## Affected products

- Cal.com cal.diy up to 4.9.4

## Timeline

- 2026-04-06: disclosed: Vulnerability details and PoC published on GitHub Gist
- 2026-05-23: advisory: CVE-2026-9303 published via VulDB/NVD

## References

- [https://gist.github.com/YLChen-007/26663d9558e15994176dc420d2e11d48](https://gist.github.com/YLChen-007/26663d9558e15994176dc420d2e11d48)
- [https://gist.github.com/YLChen-007/dafada36e356bc895b09829d8ec57e49](https://gist.github.com/YLChen-007/dafada36e356bc895b09829d8ec57e49)
- [https://vuldb.com/submit/812173](https://vuldb.com/submit/812173)
- [https://vuldb.com/submit/812175](https://vuldb.com/submit/812175)
- [https://vuldb.com/vuln/365250](https://vuldb.com/vuln/365250)
- [https://vuldb.com/vuln/365250/cti](https://vuldb.com/vuln/365250/cti)

## Related threats

- [Cal.com authorization bypass in webhook handler](https://junglewise.ai/threats/cve-2026-112043-a-weakness-has-been-identified-in-calcom-cal-com-and-cal-diy-up)
- [Cal.com credentials delete cross-team privilege escalation](https://junglewise.ai/threats/cve-2026-109143-a-vulnerability-was-determined-in-calcom-cal-com-and-cal-diy-up)
- [Cal.com remote code execution via Next.js RSC deserialization](https://junglewise.ai/threats/cve-2025-71389-cal-com-remote-code-execution-via-next-js-rsc-deserialization)
- [Cal.com stored XSS in booking question labels](https://junglewise.ai/threats/cve-2024-58355-cal-com-stored-xss-in-booking-question-labels)
- [Calcom cal.diy repository takeover via GitHub Actions pull_request_target](https://junglewise.ai/threats/cve-2024-58354-calcom-cal-diy-repository-takeover-via-github-actions-pull)