CVE-2025-64422

MediumCVSS 4.3/10Last modified Oct 7, 2026

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. This enables unlimited credential stuffing and brute-force attempts against user and admin accounts. As of time of publication, it is unclear if a patch is available.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
coollabsio	coolify	>= 4.0.0-beta.434

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-688j-rm43-5r8xExploit, Vendor Advisory

Timeline

Published: Jan 5, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-644238.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including CVE-2025-644248.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including CVE-2025-644258.1Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including CVE-2025-644276.5ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficie CVE-2025-644289.8Dataease is an open source data visualization analysis tool. Versions prior to 2.10.17 are vulnerable to JNDI injection. A blacklist was add CVE-2025-644296.5DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. Th CVE-2025-64437.2Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restric CVE-2025-644307.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions 4.2.0 through 7.5.3, and CVE-2025-644318.7Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (CVE-2025-644324.7KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the CVE-2025-644336.5KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, a vulnerability was discovered that allows a VM to CVE-2025-644346.3KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler