Vulnerability Description
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/coollabsio/coolify
- https://github.com/coollabsio/coolify/blob/v4.3.17/app/Http/Controllers/OauthCon
- https://github.com/coollabsio/coolify/blob/v4.3.17/routes/web.php
- https://github.com/geo-chen/oss/blob/main/coolify.md
- https://www.vulncheck.com/advisories/coolify-through-4.3.17-oauth-account-takeov
FAQ
What is CVE-2026-86117?
CVE-2026-86117 is a vulnerability with a CVSS score of 8.1 (HIGH). Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider as...
How severe is CVE-2026-86117?
CVE-2026-86117 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-86117?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.