Coolify, an open-source server and application management tool, had a weakness in its password reset functionality prior to version 4.0.0-beta.471. The TrustProxies middleware was configured to trust all proxies, accepting the X-Forwarded-Host header from any source, which is spoofable. Additionally, the TrustHosts middleware intended to prevent host header attacks was ineffective due to a circular caching dependency that prevented host validation. Consequently, when a password reset was requested, the reset URL generated could be crafted to point to an attacker-controlled domain. An unauthenticated attacker could exploit this to send password reset emails with malicious links, potentially leading to token theft and account takeover. The vulnerability is addressed in version 4.0.0-beta.471.

An unauthenticated attacker can exploit the vulnerability to send password reset emails containing links that point to attacker-controlled domains. This enables the attacker to steal password reset tokens, which can lead to account takeover. The vulnerability does not impact confidentiality directly but compromises integrity by allowing unauthorized account access. Availability is not affected.

The vulnerability is fixed in Coolify version 4.0.0-beta.471. Users should upgrade to this version or later to remediate the issue. No official patch or workaround is indicated beyond upgrading. Patch status is not explicitly confirmed beyond the fixed version; users should verify with vendor advisories for the latest remediation guidance.