CVE-2026-86117— Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching
Quick assessment
Affected
coollabsio coolify
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Coolify 版本至 4.3.17 存在一个认证绕过漏洞，位于 OAuth 回调处理器中。该漏洞允许系统仅基于电子邮件地址将用户登录到现有账户，而未验证提供商的声明或绑定 OAuth 身份。攻击者可以在任何已启用的 OAuth 提供商处注册受害者的电子邮件地址，从而以该用户身份获取已认证的会话，进而绕过密码要求和双因素认证。
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory DiscoveryAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| coollabsio | coolify | ≤ 4.3.17 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86117
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching
Source: CVE Program / CVE List V5
Vulnerability Description
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| coollabsio | coolify | 0 ~ 4.3.17 | - |
|
II. Public POCs for CVE-2026-86117
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86117
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86117 (1)
Proof of Concept for CVE-2026-86117 (1)
-
🔗 coolify/routes/web.php at v4.3.17 · coollabsio/coolify · GitHub technical-description
Vendor Pages for CVE-2026-86117 (1)
Other References for CVE-2026-86117 (1)
IV. Related Vulnerabilities
Same product: coolify
-
CVE-2026-84694
Coolify before 4.2.0 Remote Code Execution via Environment V -
CVE-2026-15507
coollabsio Coolify Policy Policies authorization -
CVE-2026-59734
Coolify: OS Command Injection in Health Check Configuration -
CVE-2026-42201
Coolify: OS Command Injection via Database Credential Fields -
CVE-2026-34158
Coolify: Command injection via single-quote breakout in Dock
Same vendor: coollabsio
-
CVE-2026-84694
Coolify before 4.2.0 Remote Code Execution via Environment V -
CVE-2026-15507
coollabsio Coolify Policy Policies authorization -
CVE-2026-59734
Coolify: OS Command Injection in Health Check Configuration -
CVE-2026-42201
Coolify: OS Command Injection via Database Credential Fields -
CVE-2026-34158
Coolify: Command injection via single-quote breakout in Dock
Same weakness: CWE-287
-
CVE-2026-18056
HivePress Authentication <= 1.1.4 - Unauthenticated Authenti -
CVE-2026-75816
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Ac -
CVE-2026-13447
MStore API <= 4.20.0 - Unauthenticated Authentication Bypass -
CVE-2026-53761
Frappe CRM: Authentication Bypass via Logged Invitation Keys -
CVE-2026-16892
IBM i is Affected By An Improper Authentication Vulnerabilit
V. Comments for CVE-2026-86117
No comments yet