Executive brief
Coolify, an open-source tool for managing servers and applications, was found to have a security flaw in its password reset process. An attacker could trick the system into sending a password reset email that contains a link leading to a malicious website instead of the real Coolify dashboard. If a user clicks this link, the attacker can steal their login credentials and take over their account.
Technical details
Coolify prior to version 4.0.0-beta.471 is vulnerable to host header injection leading to account takeover. The TrustProxies middleware was configured to trust all proxies ($proxies = '*'), allowing the X-Forwarded-Host header to be accepted from any source. Simultaneously, the TrustHosts middleware failed to validate hosts due to a circular caching dependency. When a password reset is requested, the application generates the reset URL using the request-derived host rather than a static server-side configuration. An unauthenticated remote attacker can exploit this by sending a password reset request with a spoofed host header, causing the system to email the victim a reset link pointing to an attacker-controlled domain. This allows the attacker to capture the reset token and compromise the account. The issue is fixed in version 4.0.0-beta.471 by using server-side configuration for URL generation.
Affected products
- coollabsio Coolify < 4.0.0-beta.471
Timeline
- 2026-03-28: patched: Fix merged into main branch
- 2026-04-09: advisory: Release v4.0.0-beta.471 published
- 2026-07-07: disclosed: CVE published to NVD