Loading story…
A critical remote code execution flaw tracked as CVE-2025-71389 affects the self-hosted Cal.com cal.diy product in versions before 5.9.9, allowing attackers to execute arbitrary code on the server without authentication or user interaction. The bug stems from Cal.com bundling a vulnerable Next.js release affected by the React Server Components deserialization issue CVE-2025-55182, enabling exploitation through a single crafted HTTP request to an RSC endpoint. The vulnerability has been described as severe, with reporting citing a CVSS 10.0 rating and weakness mapping to CWE-94.
The issue was fixed in cal.diy 5.9.9 by updating the affected Next.js dependency. Reporting on the upstream Next.js flaw says it was added to CISA's Known Exploited Vulnerabilities catalog and has seen public proof-of-concept release and real-world abuse by multiple threat actors, including activity linked to cryptominer deployment. Organizations running self-hosted Cal.com instances are being urged to upgrade immediately, limit exposure of RSC endpoints, reduce internet-facing access where possible, and review logs for signs of exploitation attempts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Cal.com fixed CVE-2025-71389 in cal.diy version 5.9.9 by updating the bundled vulnerable Next.js dependency. The flaw affected versions before 5.9.9 and allowed unauthenticated remote code execution via crafted RSC requests.
The upstream Next.js React Server Components deserialization vulnerability, CVE-2025-55182, was added to CISA's Known Exploited Vulnerabilities catalog. The reference says public proof-of-concept code existed and multiple threat actors had exploited it, including for cryptominer delivery.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **critical authentication bypass** in the Cal.com open-source scheduling platform allows remote attackers to **hijack arbitrary user accounts** by abusing a flaw in a custom *NextAuth* JWT callback used during session updates. Tracked as **CVE-2026-23478** (reported as **CVSS 10.0**), the issue affects Cal.com versions **>= 3.1.6 and < 6.0.7** and is exploitable over the network with minimal prerequisites—primarily knowledge of a victim’s email address. The weakness occurs when the session trigger is set to `"update"`, where Cal.com improperly accepts **client-controlled identity fields** and writes them into the JWT without server-side validation (mapped to issues such as **CWE-602** and **CWE-639**). An attacker can send a single API call like `session.update({ email: "victim@example.com" })` to produce a manipulated token that retains the attacker’s `sub` but swaps in the victim’s email; subsequent requests are treated as the victim because the application looks up users using the attacker-controlled `token.email` field. Successful exploitation yields full access to victim data and capabilities (bookings, event types, integrations, org membership, billing, and potentially admin privileges), and **2FA/external IdP associations do not mitigate** because the compromise occurs at the session token level; **Cal.com 6.0.7+** is cited as containing the fix.
Jun 29, 2026
A critical unauthenticated remote code execution flaw in React Server Components, tracked as **CVE-2025-55182** and widely dubbed **React2Shell**, exposed React 19 server-side packages and downstream frameworks including **Next.js App Router**. The bug stems from unsafe deserialization in the RSC/Flight protocol, allowing a single crafted HTTP request to reach vulnerable server function paths and execute arbitrary code in default deployments, including some apps that did not explicitly define Server Function endpoints. React released fixes for `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in **19.0.1**, **19.1.2**, and **19.2.1**, while Next.js issued related guidance under **CVE-2025-66478** for affected 15.x, 16.x, and certain canary releases; vendors stressed that WAF rules and hosting-provider mitigations are only temporary and that patching and redeployment are required. Security firms and vendors reported rapid weaponization after disclosure, with public exploit code, Nuclei and Metasploit support, and confirmed in-the-wild exploitation against internet-facing Next.js and other RSC-enabled applications. Reported post-compromise activity included **XMRig** cryptominers, **Sliver**, **MeshAgent**, **Cobalt Strike**, **SNOWLIGHT**, **ShadowPAD**, credential theft targeting cloud and Kubernetes environments, and persistence mechanisms tied to multiple China-linked actors and other threat groups; CISA added the flaw to its **Known Exploited Vulnerabilities** catalog. Researchers estimated broad exposure across cloud environments and web assets, while Cloudflare, Akamai, Imperva, Google Cloud, and others deployed emergency protections, underscoring the scale and urgency of remediation.
Jul 23, 2026
A critical remote code execution vulnerability in React Server Components-related packages is affecting widely used parts of the React ecosystem, including deployments tied to **Next.js**, **React Router**, **Expo**, **Redwood SDK**, **Waku**, and `@vitejs/plugin-rsc`. The flaw allows an unauthenticated attacker to execute arbitrary code on a vulnerable system through an HTTP request. Affected versions include `19.0`, `19.1.0`, `19.1.1`, and `19.2.0` of `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack`, while patched releases are `19.0.1`, `19.1.2`, and `19.2.1`. Authorities warned that exploitation is already active in Finland and that public exploit methods are available, increasing the likelihood of rapid opportunistic attacks against exposed applications. Officials said attackers may use the vulnerability not only for visible abuse such as cryptomining but also to establish persistent access, and urged organizations to patch immediately and assess internet-exposed systems for signs of compromise.
Jun 29, 2026