CVE-2026-86117: Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coolifyto a version that resolves this vulnerability.Fixed in 4.3.17
Event History
Frequently Asked Questions
Who is exposed to this issue?
Coolify installations through version 4.3.17 are exposed when an OAuth provider is enabled. Accounts whose email addresses can be registered by an attacker at that provider are at risk of takeover.
What does an attacker need to exploit it?
The attacker does not need an existing Coolify account, password, or second factor. They need to register the victim's email address with any OAuth provider enabled by the Coolify instance and complete the OAuth sign-in flow.
Does two-factor authentication protect affected accounts?
No. The vulnerable OAuth callback can create an authenticated session for an existing account based only on the email address, bypassing both password requirements and two-factor authentication.
What configuration should be prioritized for mitigation if patching is not immediately possible?
Disable enabled OAuth providers to prevent exploitation through the affected OAuth callback flow. The provided information does not identify another workaround.