Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

calcom/cal.com

              main @ 176037d
            

229

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Auth Bypass: 118 prior fixes. Scrutinize any change in this area.

packages/features/auth/lib/next-auth-options.ts: most-fixed (12 issues). Treat as high-risk during review.

174 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple critical and high-severity fixes in the authentication core, including password verification bypass, SAML tenant validation, and JWT subject handling, indicate a high-risk surface for account takeover.

Auth Bypass: Multiple fixes address API key verification bypasses, including a critical flaw allowing unauthenticated admin access via customPrisma and incorrect expiry checks, making the API key middleware a high-risk component.

Auth Bypass: Signup flow has been repeatedly patched for account takeover via email case sensitivity, invite token bypass, and missing uniqueness checks, indicating a complex and vulnerable registration process.