Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers can register a victim's email address on any enabled OAuth provider to obtain authenticated sessions as that user, bypassing password requirements and two-factor authentication.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-86117 Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email add… https://www.cve.org/CVERecord?id=CVE-2026-86117
Post summary
The text announces an authentication bypass flaw in Coolify v4.3.17’s OAuth callback handling, but does not provide any PoC, exploit, patch, or evidence of active exploitation.
Coolify's OAuth callback logs a user in on an email match alone, bypassing the password and 2FA. Affected through 4.3.17, which is the current release. No fixed version yet, and no exploitation reported. Disabling OAuth providers is the mitigation. https://severitydaily.com/coolify-cve-2026-86117-oauth-email-match-no-fixed-version/
Post summary
Coolify version 4.3.17 allows an attacker to log in with just an email match, bypassing credentials and 2FA; no patch yet, no exploits reported, but disabling OAuth providers mitigates the risk.