CVE-2023-37919: Cal.com not expiring old sessions after enabling 2FA
Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner's identity. As of time of publication, no known patches or workarounds exist.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-37919?
The severity of CVE-2023-37919 is classified as high due to unauthorized access risks from active sessions remaining after 2FA is enabled.
How do I fix CVE-2023-37919?
To fix CVE-2023-37919, ensure that all devices are logged out after enabling 2FA for your Cal.com account.
What impact does CVE-2023-37919 have on user accounts?
CVE-2023-37919 allows active sessions to persist on devices, potentially enabling unauthorized access if the session is compromised.
Which versions of Cal.com are affected by CVE-2023-37919?
CVE-2023-37919 affects all versions of Cal.com up to and including version 3.1.4.
What should I do if I notice suspicious activity on my account related to CVE-2023-37919?
If you notice suspicious activity related to CVE-2023-37919, immediately change your password and log out of all sessions.