CyberRota Analysis
AI-GeneratedThe vulnerability allows attackers to bypass authentication in Coolify versions up to 4.3.17 by exploiting the OAuth callback handler, enabling them to sign into existing accounts using only an email address. This could lead to unauthorized access to user accounts, circumventing password and two-factor authentication protections. Organizations using affected versions should prioritize patching this vulnerability to safeguard user accounts from potential compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.