CVE-2025-64422: Coollabs Coolify

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. This enables unlimited credential stuffing and brute-force attempts against user and admin accounts. As of time of publication, it is unclear if a patch is available.

Affected products

• Coollabs Coolify: before 4.0.0 (fixed in 4.0.0); version 4.0.0 only

Published 2026-01-05. Last modified 2026-10-07.