CVE-2026-86117CWE-287

CVE-2026-86117

High · published September 5, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
51.5
In the wild
Unconfirmed
What it is

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00673 · 51.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-05T14:16Z
References (5)
https://github.com/coollabsio/coolify · [email protected]https://github.com/coollabsio/coolify/blob/v4.3.17/app/Http/Controllers/OauthController.php · [email protected]https://github.com/coollabsio/coolify/blob/v4.3.17/routes/web.php · [email protected]https://github.com/geo-chen/oss/blob/main/coolify.md · [email protected]https://www.vulncheck.com/advisories/coolify-through-4.3.17-oauth-account-takeover-via-unverified-email-matching · [email protected]
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 09:59Z
    Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching
    cvelistv5