CVE-2026-86117

Katalog CVE

CVSS 8.1 · High EPSS 0,67%

Kerentanan Improper Authentication. Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.

Rincian

Terbit di NVD

5 September 2026

Terakhir diubah

10 September 2026

Status NVD

Deferred

CVSS 3.1

8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/coollabsio/coolify
• https://github.com/coollabsio/coolify/blob/v4.3.17/app/Http/Controllers/OauthController.php
• https://github.com/coollabsio/coolify/blob/v4.3.17/routes/web.php
• https://github.com/geo-chen/oss/blob/main/coolify.md
• https://www.vulncheck.com/advisories/coolify-through-4.3.17-oauth-account-takeover-via-unverified-email-matchi...