Vulnerability · Published Sep 5, 2026 · Assigned by VulnCheck

CVE-2026-86117Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching

High 8.1

In plain English

A high-severity improper authentication in coolify from coollabsio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.7%top 47.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.

Affected products (as reported)

Vendor	Product	Versions
coollabsio	coolify	0 – through 4.3.17

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Researcher write-up technical-description
callback(): email-only match then Auth::login technical-description
Unauthenticated /auth/{provider}/callback route technical-description
https://github.com/coollabsio/coolify product
VulnCheck Advisory: Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching third-party-advisory