CVE-2026-86117

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.3.18

Description An authentication bypass exists in the OAuth callback handler. The system signs users into existing accounts based solely on the email address without verifying provider assertions or binding OAuth identities. This allows an attacker to register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.

Recommendations Update to version 4.3.18 or later.