1. Unverified Google Calendar Webhook Allows Forced Sync Injection in Cal.com Platform
A critical security gap has been identified in the Cal.com platform's Google Calendar webhook endpoint, potentially exposing users to unauthorized calendar manipulation. The vulnerability, classified as HIGH severity, exists in the `/api/webhook/google-calendar` route, where incoming webhook requests bypass essential s...