CVE-2026-100746 in Coolify
Summary
by MITRE • 09/27/2026
A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 4.1.1 mitigates this issue. The patch is identified as fc89e357feed5180ed1ab5eb9cb330578f025539. The affected component should be upgraded.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
A critical authentication bypass vulnerability has been identified in Coolify, an open-source self-hostable Heroku alternative, specifically within versions up to 4.1.0. This flaw resides in the GitHub App Setup Handler component and affects the Github::redirect function located in the file /webhooks/source/github/redirect. The core technical issue stems from improper validation of the state argument passed during the OAuth authorization flow initiated by the GitHub integration. By manipulating this parameter, an attacker can bypass the expected authentication checks, effectively gaining unauthorized access to administrative functions or sensitive application data without valid credentials. This represents a significant failure in implementing secure session management and token verification protocols, allowing remote attackers to exploit the misconfiguration from any network location where the service is accessible.
The operational impact of this vulnerability is severe due to its potential for remote exploitation by unauthenticated actors. Since the state parameter manipulation leads directly to missing authentication checks, an attacker can potentially hijack administrative sessions or perform actions intended only for verified users within the Coolify environment. This could result in unauthorized deployment of code, modification of infrastructure configurations, or exfiltration of sensitive data stored within the platform. The fact that a public exploit exists significantly lowers the barrier to entry for malicious actors, increasing the likelihood of active exploitation in the wild. Organizations relying on Coolify for their development workflows are at immediate risk if they have not yet applied security patches or restricted access to vulnerable instances.
From a standards perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-345 Insufficient Verification of Data Authenticity, as the system fails to adequately verify the integrity and origin of the state parameter during the OAuth handshake process. In terms of offensive security frameworks, this exploitation technique corresponds to MITRE ATT&CK T1078 Valid Accounts or potentially T1190 Exploit Public-Facing Application, depending on whether the attacker uses stolen credentials or purely exploits the logic flaw to bypass authentication entirely. The vulnerability highlights the importance of rigorous input validation and secure state management in web application frameworks that integrate with third-party identity providers like GitHub.
To mitigate this risk, it is imperative for all affected systems running Coolify version 4.1.0 or earlier to upgrade immediately to version 4.1.1 or later. The developers have addressed the flaw through patch fc89e357feed5180ed1ab5eb9cb330578f025539, which corrects the logic within the redirect function to properly validate the state argument before proceeding with authentication steps. Until the upgrade is completed, administrators should consider implementing network-level access controls such as IP whitelisting or reverse proxy configurations that restrict public exposure of the GitHub webhook endpoints. Additionally, monitoring logs for unusual patterns in OAuth redirection requests can help detect attempted exploitation activities while patching efforts are underway.