CVE-2025-64425 is a vulnerability classified under CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax) affecting Coolify, an open-source and self-hostable tool used to manage servers, applications, and databases. The vulnerability exists in Coolify versions up to and including 4.0.0-beta.434. An attacker can exploit this by initiating a password reset for a victim account and modifying the HTTP Host header in the request to a malicious domain controlled by the attacker. As a result, the victim receives a password reset email containing a link that points to the attacker’s domain rather than the legitimate Coolify domain. When the victim clicks this link, the password reset token is sent to the attacker’s server. This token can then be used by the attacker to reset the victim’s password and take over their account. The attack requires no authentication or privileges and no prior knowledge of the victim’s credentials, but it does require the victim to interact by clicking the malicious link. The vulnerability stems from insufficient validation and neutralization of the Host header in the password reset email generation process, allowing header injection and phishing-style token theft. As of the publication date, no patch has been released, and no known exploits have been observed in the wild. The CVSS v4.0 score of 8.5 indicates a high severity due to the ease of remote exploitation without authentication, the critical impact on confidentiality and integrity of user accounts, and the potential for full account takeover. This vulnerability poses a significant risk to organizations relying on Coolify for infrastructure management, as compromised accounts could lead to unauthorized access to critical systems and data.

For European organizations, the impact of CVE-2025-64425 can be severe. Coolify is used to manage servers, applications, and databases, so account compromise could lead to unauthorized access to critical infrastructure components. Attackers gaining control over user accounts can manipulate deployments, access sensitive data, or disrupt services. This can result in data breaches, service outages, and loss of trust. Given the vulnerability requires no authentication and can be triggered remotely, the attack surface is broad. The necessity of user interaction (clicking the malicious link) means social engineering is a key component, which can be facilitated via phishing campaigns. Organizations in sectors with high regulatory requirements such as finance, healthcare, and government are particularly at risk due to the potential exposure of sensitive personal or operational data. Additionally, compromised accounts could be leveraged for lateral movement within networks, increasing the scope of impact. The lack of a patch at the time of disclosure means organizations must rely on mitigations to reduce risk until an official fix is available.

1. Immediately audit and monitor password reset workflows and email templates within Coolify to detect any anomalies or unauthorized Host header manipulations. 2. Implement strict validation and sanitization of the Host header in all HTTP requests, ensuring that only legitimate, whitelisted domains are used when generating password reset links. 3. Educate users about phishing risks, emphasizing caution when clicking password reset links, especially if received unexpectedly. 4. Employ multi-factor authentication (MFA) on all user accounts to reduce the impact of credential compromise. 5. Monitor logs for unusual password reset requests or multiple reset attempts targeting the same account. 6. Restrict access to Coolify management interfaces to trusted networks or VPNs to reduce exposure. 7. If possible, temporarily disable password reset functionality or implement manual verification until a patch is released. 8. Stay updated with vendor communications and apply patches immediately once available. 9. Consider deploying web application firewalls (WAFs) with rules to detect and block suspicious Host header manipulations. 10. Conduct regular security assessments and penetration tests focusing on authentication and password reset mechanisms.