CVE-2025-64425
Coollabs Coolify ≤ 4.0.0
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-64425 is a high-severity Improper Neutralization of HTTP Headers for Scripting Syntax (CWE-644) vulnerability in Coollabs Coolify. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-64425 is a vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. It affects versions up to and including v4.0.0-beta.434. The issue stems from an attacker being able to initiate a password reset for a victim user and modify the Host header of the request to a malicious value. This results in the victim receiving a password reset email with a link pointing to the attacker's server instead of the legitimate one.
An unauthenticated attacker with network access can exploit this vulnerability by targeting any user account, requiring low complexity and user interaction from the victim. If the victim clicks the malicious link, their reset token is sent to the attacker's server, allowing the attacker to use it to change the victim's password and achieve full account takeover. The CVSS v3.1 base score is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts with no availability impact.
The primary references include the GitHub security advisory at GHSA-f737-2p93-g2cw and a detailed report at a Google Drive link. As of the CVE publication on 2026-01-05T21:16:12.857, it remains unclear if a patch is available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206233
Vulnerability Data
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim, and modify the host header of the request to…
more
a malicious value. The victim will receive a password reset email, with a link to the malicious host. If the victim clicks this link, their reset token is sent to the attacker's server, allowing the attacker to use it to change the victim's password and takeover their account. As of time of publication, it is unclear if a patch is available.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V4.2.3
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly requires checking/neutralizing untrusted data such as HTTP headers before they reach browser components.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper output encoding and header sanitization to prevent scripting injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing catches header-injection issues before release, covering most of the weakness.
Secure development lifecycle mandates input validation and output encoding that directly prevents header-injection flaws.
Application security requirements explicitly call for neutralizing untrusted data in HTTP headers.
Secure architecture principles reduce injection surfaces but do not prescribe header-specific controls.
Secure coding standards require proper escaping or rejection of scripting syntax in HTTP headers.