EUVD-2026-71949
GHSA-rchm-727g-v36m
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote and unauthenticated (AV:N/PR:N/UI:N), but requires an enabled provider plus controlling the victim's email there (AC:H); account takeover yields full C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.
AnalysisAI
Authentication bypass in Coolify (self-hosted PaaS) through version 4.3.17 lets remote attackers take over any account by matching only on email address during the OAuth callback. Because the OauthController fails to verify provider assertions or bind an OAuth identity to the local account, an attacker who registers a victim's email on any enabled OAuth provider is signed in as that victim, defeating passwords and two-factor authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the target Coolify instance (through 4.3.17) has at least one OAuth/social login provider enabled, and that the attacker can register or control the victim's exact email address on that enabled provider (the CVSS 4.0 AT:P present attack requirement). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The impact ceiling is high - full account takeover including administrative accounts, mapped to VC:H/VI:H/VA:H - and authentication is unauthenticated (PR:N) with no victim interaction (UI:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a fixed release above 4.3.17 once published by coollabsio (monitor https://github.com/coollabsio/coolify releases and the VulnCheck advisory); no exact patched version number is confirmed in the provided data, so treat 'latest release after 4.3.17' as the target and verify the OAuth binding fix is present. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, disable OAuth authentication if operationally feasible and revert to local-only authentication, or immediately restrict network access to Coolify administrative interfaces to known IP ranges only and audit recent login logs for suspicious OAuth callback activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today