CVE-2025-64425CWE-644

CVE-2025-64425

High ยท published January 6, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

๐Ÿšจ A crafty attacker can hijack password resets with just a malicious link! ๐Ÿ”ฅ Think of it like a thief sending a fake invitation to a party โ€” the victim unknowingly shows up at the wrong place, handing over access to their personal belongings! If an attacker successfully exploits this vulnerability, they could take complete control of a victim's account. This means changing passwords, accessing sensitive data, and wreaking havoc on their applications โ€” absolutely devastating!

Put simply

Think of it like a thief sending a fake invitation to a party โ€” the victim unknowingly shows up at the wrong place, handing over access to their personal belongings! In Coolify versions up to v4.0.0-beta.434, attackers can manipulate the host header in password reset requests, tricking victims into clicking a link to a malicious server that captures their reset token.

What to do

If an attacker successfully exploits this vulnerability, they could take complete control of a victim's account. This means changing passwords, accessing sensitive data, and wreaking havoc on their applications โ€” absolutely devastating! Upgrade Coolify immediately to the latest version to mitigate this risk. Additionally, consider implementing security measures like validating host headers and educating users about suspicious links in emails. You've got this! With these steps, you'll protect your accounts and keep those online thieves at bay! ๐Ÿฆธ

The record
Technical detail
CVSS v3.1
8.1 ยท HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00425 ยท 35.7th percentile
Weakness
CWE-644 ยท Improper Neutralization of HTTP Headers for Scripting Syntax
Published
2026-01-06T02:16Z
Affected products (425)
ProductVersionsFixed in
coollabs/coolify< 4.0.04.0.0
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
coollabs/coolifyall versionsโ€”
References (3)
EPSS history
Timeline
  • 05 JAN 20:49Z
    Coolify has host header injection in forgot password
    cvelistv5