by Kastro
Paper/Archive/CVE-2026-86117

CVE-2026-86117

coollabsio coolify — Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching

EPSS 0.7%CVSS 9.2
critical.is priorityof 100
38
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 52.1.521 × 2010.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.

Affected

ProductAffectedFixed inSource
coolify≤ 4.3.17–CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupgithub.com/geo-chen/oss/blob/main/coolify.mdwriteupgithub.com/coollabsio/coolify/blob/v4.3.17/app/Http/Controllers/OauthController.phpwriteupgithub.com/coollabsio/coolify/blob/v4.3.17/routes/web.phprefgithub.com/coollabsio/coolifywriteupvulncheck.com/advisories/coolify-through-4.3.17-oauth-account-takeover-via-unverified-email-matching