CVE-2026-100746
Received Received - Intake

Authentication Bypass in Coolify via GitHub State Manipulation

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulDB

Description
A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed remotely. The exploit has been made public and could be used. Upgrading to version 4.1.1 mitigates this issue. The patch is identified as fc89e357feed5180ed1ab5eb9cb330578f025539. The affected component should be upgraded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100746
EUVD
EUVD-2026-87884

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
coollabsio coolify to 4.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Coolify versions up to 4.1.0. It involves a missing authentication issue in the GitHub App setup handler where the 'state' parameter can be manipulated. This allows remote attackers to bypass authentication during GitHub App setup via the /webhooks/source/github/redirect endpoint. The flaw was fixed in version 4.1.1.

Detection Guidance

This vulnerability affects Coolify versions up to 4.1.0. Check your Coolify version with: curl -s https://your-coolify-domain.com/api/version | grep version. If the version is <=4.1.0, the system is vulnerable. Inspect GitHub App setup logs for unauthorized redirects or missing state validation.

Impact Analysis

An attacker could exploit this to gain unauthorized access to GitHub App setup processes, potentially leading to unauthorized deployments or data access. Since Coolify manages deployments and services, this could compromise applications or sensitive data hosted on the platform.

Compliance Impact

The vulnerability allows remote attackers to bypass authentication due to missing checks in the GitHub App setup handler. This could lead to unauthorized access to sensitive data or systems, potentially violating compliance requirements under GDPR (data protection) and HIPAA (health data privacy) by exposing personal or protected information.

Mitigation Strategies

Upgrade Coolify to version 4.1.1 or later immediately. Apply the patch commit fc89e357feed5180ed1ab5eb9cb330578f025539. Review and restrict GitHub App permissions to the minimum required. Monitor for unusual GitHub App installation or redirect activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100746. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart