A critical authentication bypass vulnerability in Coolify allows unauthenticated attackers to hijack user accounts, including administrative accounts, by spoofing email addresses through OAuth providers.

The vulnerability exists in the OAuth callback handler (OauthController.php), which trusts the email address returned by an OAuth provider without verifying it or binding it to a unique OAuth identity. Because the application uses this email to log in users directly, an attacker can register a victim's email address on a supported OAuth provider to bypass password requirements and two-factor authentication (2FA).

Successful exploitation allows an unauthorized user to gain full access to any account, including administrative accounts, within the Coolify instance. This results in complete compromise of the application environment, potential data exfiltration, and the ability to modify infrastructure managed by Coolify. With a CVSS score of 8.1, the high severity reflects the ease of account takeover and the complete bypass of established security controls like 2FA.

Immediate Action: As no official patch is currently available, administrators should immediately disable all OAuth login providers within the Coolify settings to prevent exploitation.

Proactive Monitoring: Review application access logs for unusual login patterns or multiple accounts associated with a single OAuth provider email address.

Compensating Controls: Ensure that the Coolify instance is not exposed to the public internet where attackers can freely interact with OAuth callback endpoints.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the researcher's technical write-up.

This is a critical security flaw that enables total account takeover without requiring credentials or 2FA. Given the availability of a published proof-of-concept, administrators must treat this as a high-priority risk. Immediately disable OAuth authentication methods until an official patch is released by the vendor to ensure the integrity of your user base and the security of your managed infrastructure.