The vulnerability is caused by the TrustProxies middleware automatically trusting all proxy requests and accepting an X-Forwarded-Host header from any source, while a circular caching dependency prevents the TrustHosts middleware from validating hosts. When a user requests a password reset, the reset URL is constructed from the host value supplied by the request. An unauthenticated attacker can therefore send a forged X-Forwarded-Host header to generate a reset email that points to an attacker‑controlled domain. Capturing the returned token allows the attacker to complete the reset, gaining full control of the victim’s account. The weaknesses align with CWE‑346 (Untrusted Content Serving) and CWE‑640 (Trusting of an Untrusted Delegated Proxy).

Any deployment of Coolify by coollabsio before version 4.0.0-beta.471 is susceptible, as the vulnerable code resides in the web application’s trust‑proxy handling and password‑reset logic.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % combined with no listing in the CISA KEV catalog suggests that exploitation has not yet been observed. The exploit can be carried out remotely via a simple HTTP request that includes a forged X-Forwarded-Host header; no authentication is required to trigger the password‑reset flow. If successful, the attacker obtains an token that permits account takeover.