CVE-2025-64422 Rate-limit bypass on login via X-Forwarded-Host header
Attackers can bypass login rate limits by manipulating headers, enabling unlimited brute-force attacks against user and admin accounts in Coolify.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-64422?
CVE-2025-64422 is a medium-severity vulnerability in coollabsio coolify, published on 5 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /login endpoint advertises a rate limit of 5 requests but can be trivially bypassed by rotating the X-Forwarded-For header. This enables unlimited credential stuffing and brute-force attempts against user and admin accounts. As of time of publication, it is unclear if a patch is available.
Weakness: CWE-770
Which versions are affected by CVE-2025-64422?
It affects 1 product.
Products include Coollabs Coolify.
How do I fix CVE-2025-64422?
No fix has been published for CVE-2025-64422 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-64422 being exploited?
There is no known exploitation of CVE-2025-64422 in the wild and no public exploit code.
Other vulnerabilities in coollabsio coolify
- CVE-2025-59157 Coolify has Git Repository RCE
- CVE-2025-64420 Coolify members can see private key of root user
- CVE-2025-66209 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup
- CVE-2025-22609 Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)
- CVE-2025-22611 Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE)
Sources
Also known as GHSA-688j-rm43-5r8x.