CVE-2026-86117: Coolify OAuth Authentication Bypass Flaw

CVE-2026-86117 is an authentication bypass flaw in Coolify through version 4.3.17 affecting OAuth callback handlers. Attackers can hijack accounts by registering victim email addresses on OAuth providers. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-86117 Overview

CVE-2026-86117 is an authentication bypass vulnerability affecting Coolify through version 4.3.17. The flaw resides in the OAuth callback handler, which signs users into existing accounts based solely on the email address returned by the identity provider. The handler does not verify provider assertions or bind OAuth identities to local accounts. Attackers can register a victim's email address on any enabled OAuth provider and obtain an authenticated session as that user. The bypass defeats password requirements and two-factor authentication (2FA), giving attackers full account access. The weakness is classified under [CWE-287: Improper Authentication].

Critical Impact
Remote attackers can take over any Coolify account, including administrator accounts, by controlling an OAuth provider account bound to the victim's email address.

Affected Products

Coolify versions up to and including 4.3.17
Self-hosted Coolify deployments with any OAuth provider enabled
Coolify instances allowing multiple OAuth providers for authentication

Discovery Timeline

2026-09-05 - CVE-2026-86117 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86117

Vulnerability Analysis

Coolify's OauthController processes provider callbacks by extracting the returned email address and locating a matching local user. If the email matches an existing account, the controller establishes an authenticated session for that account. The controller performs no check that the OAuth provider marked the email as verified. It also does not maintain a persistent binding between an external OAuth identity and a local user record.

Because the trust decision reduces to "does an account with this email exist," any provider that permits unverified email registration becomes an authentication oracle. The attacker only needs to create an account on an enabled provider using the victim's email. Password-based authentication and 2FA controls on the local account are never evaluated during the OAuth flow.

Root Cause

The root cause is missing verification of provider-supplied identity assertions and the absence of an OAuth-to-user binding table. The application treats the email claim as authoritative regardless of whether the provider validated ownership. This design conflates identification (email string) with authentication (proof of control).

Attack Vector

An unauthenticated remote attacker enumerates or otherwise obtains a target user's email address. The attacker registers that email on any OAuth provider enabled in the Coolify instance that allows unverified sign-ups. The attacker initiates the OAuth login flow against the Coolify instance. The callback returns the attacker-controlled provider identity carrying the victim's email, and Coolify issues a session cookie for the victim's account.

See the VulnCheck Advisory for Coolify and the OauthController source for the specific handler logic.

Detection Methods for CVE-2026-86117

Indicators of Compromise

Successful OAuth login events for accounts that historically authenticated only with a password
New OAuth provider linkages appearing immediately before privileged actions
Session establishment from IP addresses or user agents inconsistent with the account's baseline
Administrative changes made shortly after an OAuth callback for an admin account

Detection Strategies

Review Coolify authentication logs for OAuth callbacks that authenticated users who had not previously used the provider
Correlate OAuth login timestamps with subsequent configuration changes, secret access, or deployment actions
Alert on OAuth logins for administrator accounts and require secondary verification for those events

Monitoring Recommendations

Forward Coolify web and authentication logs to a centralized log store for retention and correlation
Track first-time OAuth provider associations per account and flag anomalies against historical login patterns
Monitor for reconnaissance against /auth/* OAuth callback routes defined in routes/web.php

How to Mitigate CVE-2026-86117

Immediate Actions Required

Disable all OAuth providers in Coolify configurations until a fixed version is deployed
Rotate credentials, API tokens, and deployment secrets for any accounts that may have been accessed
Audit administrator accounts and recent configuration changes for unauthorized activity
Restrict network exposure of the Coolify management interface to trusted networks or a VPN

Patch Information

The vulnerability affects Coolify through version 4.3.17. Upgrade to a release later than 4.3.17 that verifies OAuth provider email assertions and enforces a persistent OAuth-identity-to-user binding. Track fixes in the GitHub Coolify Repository and consult the Coolify OAuth account takeover writeup for remediation context.

Workarounds

Disable OAuth authentication and require password plus 2FA for all users
Limit enabled OAuth providers to those that enforce mandatory email verification
Place the Coolify instance behind a reverse proxy that enforces additional authentication on /auth/* routes
Restrict administrator accounts to a separate email domain not registerable on public OAuth providers

bash

# Configuration example: disable OAuth providers in Coolify environment
# Remove or comment out OAuth provider credentials in the Coolify .env file
# GITHUB_OAUTH_CLIENT_ID=
# GITHUB_OAUTH_CLIENT_SECRET=
# GOOGLE_OAUTH_CLIENT_ID=
# GOOGLE_OAUTH_CLIENT_SECRET=

# Then restart Coolify to apply the changes
docker compose -f /data/coolify/source/docker-compose.yml down
docker compose -f /data/coolify/source/docker-compose.yml up -d