Coolify CVE-2025-64425

Exploitation requires that the Coolify instance's password-reset flow builds the reset link from the incoming HTTP Host header rather than a fixed/configured application URL, allowing an attacker to inject a malicious host value into the reset email. Limiting factors: the targeted victim MUST click the poisoned link (UI:A), the attacker must know the victim's registered email, and the attack succeeds per-victim rather than en masse. Applies to Coolify versions up to and including v4.0.0-beta.434; instances that pin/validate the application base URL or reject untrusted Host headers (e.g. behind a reverse proxy enforcing a canonical host) are not exploitable.

This is a genuine, credible account-takeover vulnerability but the raw scores warrant nuance. The vendor CVSS 4.0 base of 8.5 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H) reflects unauthenticated network reachability with high confidentiality and integrity impact, which is consistent with a host-header password-reset poisoning flaw. However, EPSS is very low at 0.05% (15th percentile), signaling that mass, automated exploitation is not expected - this is a targeted, per-victim attack requiring the specific victim to click a poisoned link. There is no CISA KEV listing, so there is no confirmation of active exploitation; the elevated CVSS is driven by impact, not by observed attack volume. Publicly available exploit material exists (a GitHub Security Advisory GHSA-f737-2p93-g2cw plus a linked write-up), which lowers the bar for a motivated attacker, but successful exploitation still hinges on victim user interaction (UI:A) and, critically, on the server accepting an attacker-controlled Host header rather than a hardened/pinned application URL. Net: real priority for internet-exposed Coolify instances because the outcome is full account takeover, but the low EPSS and mandatory user interaction mean it is targeted rather than wormable. Note the input Tag 'Information Disclosure' understates the impact - this is account takeover (integrity/confidentiality), not mere disclosure.

An attacker submits a password-reset request for a victim's Coolify account while tampering with the HTTP Host header to point at an attacker-controlled domain. Coolify generates the reset email using the attacker's host, so the victim receives a legitimate-looking reset link that leaks the valid reset token to the attacker's server when clicked; the attacker then uses that token to set a new password and take over the account. A public advisory and proof-of-concept write-up exist, and the attack requires only that the victim click the emailed link (UI:A).