Coolify CVE-2026-86117

Requires that the target Coolify instance (through 4.3.17) has at least one OAuth/social login provider enabled, and that the attacker can register or control the victim's exact email address on that enabled provider (the CVSS 4.0 AT:P present attack requirement). No prior authentication to Coolify and no victim interaction are needed (PR:N/UI:N), and the victim account must already exist in Coolify for the email match to succeed. Limiting factors: instances with OAuth disabled are not exploitable via this path, and providers that strongly verify and lock email ownership raise the bar (reflected as AC:H).

The impact ceiling is high - full account takeover including administrative accounts, mapped to VC:H/VI:H/VA:H - and authentication is unauthenticated (PR:N) with no victim interaction (UI:N). However, the provided CVSS 4.0 vector (9.2) itself encodes real friction: AC:H and AT:P reflect that exploitation is not a trivial single request - the target Coolify instance must have an OAuth provider enabled, and the attacker must be able to register/control the victim's exact email address on that provider (a present/pre-condition attack requirement). This makes it high-severity but conditional rather than spray-and-pray. Exploitation status: no public exploit identified at time of analysis (a technical writeup exists at geo-chen/oss but that is analysis, not weaponized tooling); not in CISA KEV; EPSS not provided. Net: prioritize for any Coolify deployment that has social/OAuth login enabled, but the AC:H/AT:P conditions mean this is more targeted than mass-exploitable. Note the CVSS complexity signals (AC:H/AT:P) somewhat contrast with the simple conceptual attack - verify enabled-provider exposure per instance.

An attacker learns an admin's email used on a Coolify instance that has, say, GitHub or Google OAuth login enabled, then registers/controls that same email on the enabled provider. They initiate OAuth login to Coolify; the callback matches on email and issues an authenticated session as the admin, skipping the password and 2FA. A technical writeup demonstrating the flaw exists, but no turnkey public exploit is confirmed.