CVE-2025-64422: Coolify Auth Bypass Vulnerability

CVE-2025-64422 Overview

CVE-2025-64422 is an authentication bypass vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. The vulnerability exists in Coolify starting with version 4.0.0-beta.434, where the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. This enables unlimited credential stuffing and brute-force attempts against user and admin accounts. As of time of publication, it is unclear if a patch is available.

Critical Impact

Attackers can bypass rate limiting protections on the login endpoint, enabling unrestricted brute-force and credential stuffing attacks against Coolify user and admin accounts.

Affected Products

• Coolify version 4.0.0-beta.434 and later versions
• Self-hosted Coolify instances with exposed /login endpoints
• Deployments behind reverse proxies that trust X-Forwarded-For headers

Discovery Timeline

• 2026-01-05 - CVE CVE-2025-64422 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-64422

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The core issue lies in the implementation of rate limiting on Coolify's /login endpoint. While the application advertises a rate limit of 5 requests to prevent brute-force attacks, the rate limiting mechanism relies on client-provided IP addresses through the X-Forwarded-For HTTP header. Since this header can be easily manipulated by attackers, the rate limiting protection becomes ineffective.

The vulnerability allows attackers to conduct unlimited credential stuffing and brute-force attacks by simply rotating IP addresses in the X-Forwarded-For header with each request. This completely undermines the security control designed to protect user accounts from automated attack attempts.

Root Cause

The root cause of this vulnerability is the improper trust of client-supplied data for security-critical functionality. The rate limiting implementation incorrectly uses the X-Forwarded-For header value as the client identifier for tracking request counts. Since this header can be arbitrarily set by clients, attackers can spoof different IP addresses to circumvent the rate limiting mechanism entirely.

This represents a flawed security architecture where rate limiting should be based on the actual connection source IP rather than a client-controlled header value, or should implement additional safeguards such as account lockout policies independent of source IP.

Attack Vector

The attack exploits the network-accessible /login endpoint. An attacker requires no authentication or special privileges to exploit this vulnerability. The attack methodology involves:

1. Sending authentication requests to the /login endpoint
2. After reaching the 5-request rate limit threshold, rotating the X-Forwarded-For header value to a new spoofed IP address
3. Continuing brute-force or credential stuffing attempts with effectively unlimited request capacity
4. The process can be fully automated using standard HTTP client tools

The vulnerability mechanism centers on header manipulation. Rather than implementing a code example, see the GitHub Security Advisory for complete technical details on the rate limiting bypass technique.

Detection Methods for CVE-2025-64422

Indicators of Compromise

• Unusually high volume of authentication failures on the /login endpoint from varied X-Forwarded-For header values but consistent actual source IPs
• Login attempts with rapidly changing or sequential X-Forwarded-For header values
• Authentication log entries showing rate limit messages followed by continued attempts with different reported client IPs
• Successful account compromises following periods of elevated login activity

Detection Strategies

• Implement log correlation between actual source IP addresses and X-Forwarded-For header values to identify discrepancies
• Monitor for patterns of failed authentication attempts that reset after reaching the 5-request threshold
• Deploy web application firewall (WAF) rules to detect anomalous header rotation patterns
• Configure alerts for high-volume authentication failures from single source IPs regardless of reported forwarded headers

Monitoring Recommendations

• Enable detailed logging on Coolify's /login endpoint including both actual source IP and forwarded headers
• Implement real-time monitoring for authentication failure rates exceeding normal baselines
• Track account lockouts and password reset requests that may indicate successful credential compromise
• Monitor for successful logins following periods of failed authentication attempts

How to Mitigate CVE-2025-64422

Immediate Actions Required

• Restrict access to the Coolify /login endpoint to trusted IP ranges using network-level controls
• Implement additional authentication factors (MFA) for all Coolify accounts, especially administrative accounts
• Deploy a web application firewall with rate limiting based on actual source IP rather than forwarded headers
• Review authentication logs for signs of exploitation attempts or successful compromises
• Consider temporarily disabling public access to Coolify instances until a patch is available

Patch Information

As of the time of publication, it is unclear if a patch is available for this vulnerability. Administrators should monitor the GitHub Security Advisory for updates on patch availability. When a patch becomes available, prioritize updating affected Coolify installations.

Workarounds

• Configure reverse proxies to ignore or override client-provided X-Forwarded-For headers and use the actual connection source IP
• Implement network-level rate limiting using firewall rules or reverse proxy configurations that cannot be bypassed via header manipulation
• Restrict /login endpoint access to VPN or internal networks only
• Deploy account lockout policies based on username rather than source IP to limit brute-force effectiveness
• Use strong, unique passwords and enable MFA to reduce the impact of credential attacks

# Example: Nginx rate limiting configuration based on actual source IP
# Add to nginx.conf or site configuration to implement proper rate limiting

limit_req_zone $binary_remote_addr zone=login_limit:10m rate=5r/m;

server {
    location /login {
        limit_req zone=login_limit burst=3 nodelay;
        # Additional proxy configuration
        proxy_pass http://coolify_backend;
    }
}