---
id: CVE-2026-86117
title: >-
  Coolify through 4.3.17 contains an authentication bypass vulnerability in the
  OAuth callback handler that signs users into existing accounts based solely on
  email address without verifying provider assertions or binding OAuth
  identities.…
summary: >-
  Coolify through 4.3.17 contains an authentication bypass vulnerability in the
  OAuth callback handler that signs users into existing accounts based solely on
  email address without verifying provider assertions or binding OAuth
  identities.…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-287
vendor: coollabsio
product: coolify
affected:
  - coolify <= 4.3.17
published: '2026-09-05'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T16:18:01.553'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86117'
references:
  - url: 'https://github.com/coollabsio/coolify'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/coollabsio/coolify/blob/v4.3.17/app/Http/Controllers/OauthController.php
    label: disclosure@vulncheck.com
  - url: 'https://github.com/coollabsio/coolify/blob/v4.3.17/routes/web.php'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/geo-chen/oss/blob/main/coolify.md'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/coolify-through-4.3.17-oauth-account-takeover-via-unverified-email-matching
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T14:24:56.886508Z'
epss: 0.00673
epssPercentile: 0.49974
ingestedAt: '2026-09-06T07:51:56.004Z'
---

## Overview

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.