Account takeover vulnerability in Coolify by Coollabs

CVE-2025-64425

What is CVE-2025-64425?

Coolify is an open-source tool for managing server applications and databases that suffers from a significant vulnerability. In versions up to and including v4.0.0-beta.434, attackers can exploit this flaw to trigger a password reset request on behalf of a target user. By manipulating the host header in the request, attackers can redirect the password reset email to a malicious server. If the victim interacts with the provided reset link, their reset token is divulged to the attacker, allowing for unauthorized account access. Current details regarding the availability of a patch to address this issue remain unconfirmed.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References