PT-2026-1336 · Coolify · Coolify

Published 2026-01-05 · Updated 2026-01-06 · CVE-2025-64425

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Coolify versions up to and including 4.0.0-beta.434

Description Coolify is a self-hostable tool for managing servers, applications, and databases. An attacker can initiate a password reset for a victim and modify the host header of the request to a malicious value. The victim receives a password reset email containing a link to the attacker's server. If the victim clicks this link, their reset token is sent to the attacker, enabling them to change the victim’s password and take over the account. The vulnerability involves manipulating the host header in a password reset request. The affected API endpoint is the password reset functionality. The vulnerable parameter is the host header.

Recommendations Versions prior to 4.0.0-beta.434 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-644

Related Identifiers

CVE-2025-64425

GHSA-F737-2P93-G2CW

Affected Products

Coolify

References · 8

• 🔥 https://github.com/coollabsio/coolify/security/advisories/GHSA-f737-2p93-g2cw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64425.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-64425 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64425 · Security Note
• https://drive.google.com/file/d/1I5sJHcpetJbKlwVS2usAD7qmgH37Y4rw/view?usp=drive_link · Note
• https://twitter.com/VulmonFeeds/status/2008430554480304580 · Twitter Post
• https://twitter.com/CVEnew/status/2008346561370354085 · Twitter Post
• https://t.me/CVEtracker/41428 · Telegram Post