The vulnerability allows an attacker to hijack a victim’s account by registering the victim’s email on an enabled OAuth provider. The callback handler trusts the provider’s assertion solely on the email address, failing to verify provider claims or map OAuth identities to the user. The flaw falls under CWE‑287 – Improper Authentication. Once the attacker obtains an OAuth session, they bypass both password and two‑factor controls, granting full access to the victim’s account. The official description does not specify environmental restrictions, but it implies the attacker can perform the exploit from any external location with network reach to the OAuth login flow.

Coolify versions up to and including 4.3.17 from the vendor coollabsio are affected. No later official version was listed in the data, so all releases prior to the fix remain vulnerable.

The CVSS score of 9.2 classifies this as a critical vulnerability. EPSS information is unavailable and the issue is not listed in the CISA KEV catalogue, but the inherent ability to bypass authentication and the absence of provider verification make it highly exploitable. The likely attack vector is remote via the OAuth callback endpoint, where an attacker can orchestrate a new OAuth account registration using the victim’s email and then use the callback to receive an authenticated session. The vulnerability is exploitable without privileged local access and requires only the ability to coordinate with an OAuth provider’s registration process.