The vulnerability allows an unauthenticated attacker to forge a valid HMAC signature by exploiting the use of a null webhook secret in Coolify. Because PHP’s hash_hmac function treats a null key as an empty string, any attacker can calculate the expected hash and provide it in the X‑Hub‑Signature‑256 header. This bypass of authentication (CWE‑287) enables the attacker to trigger deployment endpoints, potentially executing arbitrary code, altering data, or exposing sensitive resources.

Coolify (coollabsio:coolify) is affected. Versions prior to 4.0.0-beta.474 are vulnerable. The flaw exists where the manual_webhook_secret_github field is null for newly created applications.

The CVSS score of 7.5 classifies the issue as high severity, with no EPSS value available and no listing in CISA’s KEV catalog. Attackers do not need credentials; they can send HTTP requests to the deployment webhook from any external network, provided the target is reachable. The exploitation requires a null webhook secret, a condition that many installations may have by default. Given the straightforward attack vector and the high impact of unauthorized deployments, this represents a significant risk to affected environments.