Coolify's webhook endpoints rely on an HMAC key derived from the manual_webhook_secret_github field to validate incoming requests. Before version 4.0.0-beta.474, this field is nullable and defaults to null for new applications. Since PHP's hash_hmac() function silently converts a null key to an empty string, the server computes a predictable HMAC signature using an empty key. An attacker can generate this signature independently and send a forged X-Hub-Signature-256 header to bypass authentication and trigger deployments without authorization. The vulnerability is addressed in version 4.0.0-beta.474 by ensuring the webhook secret is properly set and not nullable.

An unauthenticated attacker can forge valid webhook signatures due to the null HMAC key being treated as an empty string. This allows the attacker to trigger unauthorized deployments on affected Coolify instances, leading to potential unauthorized code execution or application manipulation. The vulnerability does not impact confidentiality or availability directly but compromises integrity by allowing unauthorized deployment triggers.

This vulnerability is fixed in Coolify version 4.0.0-beta.474. Users should upgrade to this version or later to ensure the webhook secret is properly set and the HMAC key is not nullable. There is no official patch or temporary fix other than upgrading. Until upgraded, users should manually ensure that the manual_webhook_secret_github field is set to a non-null, strong secret to prevent exploitation.