CVE-2026-86117

Coolify versions through 4.3.17 mishandle the OAuth login callback, signing users into existing accounts based solely on a matching email address without verifying the provider's assertions or binding OAuth identities to accounts. An attacker who registers the victim's email address on any OAuth provider enabled on the instance can complete the OAuth flow and be signed in as that user without knowing their password, bypassing two-factor authentication. This gives the attacker full control of the victim's Coolify account, including the ability to manage applications and deployments on the servers connected to it. Any deployment running 4.3.17 or earlier is affected, but only instances that have at least one OAuth login provider enabled are exposed to this attack path; instances using password-only authentication are not. No public proof-of-concept or in-the-wild exploitation is known, and EPSS currently estimates about a 0.4% probability of exploitation within 30 days.

What to do: Upgrade to a Coolify release newer than 4.3.17 as soon as a patched version is available (check the vendor's advisory and GitHub releases). As an interim mitigation, disable OAuth login providers and require password authentication, then review user accounts for unexpected logins or active sessions. Admins of multi-user instances should prioritize patching, since a takeover yields full control of the account and the deployment targets connected to it.