CVE-2026-86117 coollabsio CVE debrief

Who should care

System administrators and security teams using Coolify with OAuth authentication should assess exposure and verify patches. This includes reviewing OAuth configurations, ensuring secure authentication practices are in place, and monitoring systems for suspicious activity related to authentication and session management. Additionally, verifying and applying patches for Coolify version 4.3.17 or earlier is crucial. Those responsible for maintaining Coolify deployments should prioritize this vulnerability due to its critical nature and potential for exploitation. Affected operators, platform administrators, vulnerability management teams, and security teams should collaborate to ensure comprehensive mitigation and remediation efforts are undertaken promptly. This may involve coordinating with vendors for support, reviewing system logs for potential indicators of compromise, and implementing compensating controls where necessary. Given the high risk associated with this vulnerability, swift action is essential to protect against potential attacks. Therefore, it is imperative that all relevant stakeholders take immediate action to secure their environments and prevent unauthorized access to sensitive information. The Coolify development team and security community may provide additional guidance and resources to aid in remediation efforts. By taking proactive steps, organizations can minimize the risk of exploitation and maintain the security and integrity of their systems and data. Effective communication and collaboration among teams will be vital in successfully addressing this vulnerability and ensuring the continued security of Coolify deployments. Therefore, system administrators and security teams must work closely with relevant stakeholders to address this critical vulnerability promptly and effectively. This may involve conducting thorough risk assessments, implementing necessary patches and updates, and monitoring systems for any signs of suspicious activity. By prioritizing this vulnerability and taking swift action, organizations can reduce the risk of exploitation and protect their systems and data from potential harm. System administrators and security

Why it matters

CVE-2026-86117 is a critical authentication bypass vulnerability in Coolify that allows attackers to obtain authenticated sessions as victims without verifying provider assertions or binding OAuth identities. System administrators and security teams using Coolify with OAuth authentication should assess exposure and verify patches.

• Bypassing password requirements and two-factor authentication could lead to unauthorized access to user accounts.
• Attackers could obtain authenticated sessions as victims, potentially leading to sensitive data exposure.
• The vulnerability could be exploited without requiring direct interaction with the victim, making it a high-risk issue.
• Verification of OAuth configurations and user accounts may be necessary to prevent exploitation.

Technical summary

The vulnerability is caused by the OAuth callback handler in Coolify, which signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. This allows attackers to register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.

Defensive priority

High priority for systems using Coolify with OAuth authentication; verify and apply patches immediately.

Recommended defensive actions

• Verify and apply patches for Coolify version 4.3.17 or earlier
• Review and update OAuth configurations to ensure secure authentication
• Monitor systems for suspicious activity related to authentication and session management
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability details are based on the CVE Program record and the NIST National Vulnerability Database (NVD) entry. Additional information is available from various source references, including GitHub repositories and a Vulncheck advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.