Summary
Coolify's GitHub App Setup Handler does not adequately authenticate requests when processing the OAuth state value in the GitHub redirect flow. A remote attacker may manipulate this value to bypass expected authentication checks and interfere with GitHub App setup or account association.
Affected context
The issue occurs in Coolify deployments using the GitHub App integration and its redirect handler at the GitHub source setup endpoint. Risk exists when externally supplied state values are accepted without reliable validation, binding to the initiating user or session, and enforcement of the expected authentication flow.
Exploit preconditions
- Attack surface: Remotely accessible GitHub App setup redirect endpoint - Required access: Ability to send requests to the endpoint; valid
authentication may not be required
- Trigger point: Processing the state argument during the GitHub redirect
flow
- Why exploitation is possible: The handler does not sufficiently verify that
the supplied state represents an authenticated, authorized, and
user-initiated setup transaction
Why this happens
The underlying flaw is insufficient authentication and authorization of a security-sensitive redirect transaction. When an application trusts a client-controlled state value without validating its integrity, freshness, session binding, and association with the intended user, an attacker may influence the flow without satisfying the required authentication checks. This maps primarily to CWE-287, Improper Authentication, and is also related to CWE-306, Missing Authentication for Critical Function.
Potential impact
- An attacker may bypass authentication checks in the GitHub App setup flow.
- Unauthorized users could potentially associate or modify integrations.
- The vulnerability could enable account or project access beyond intended permissions.
- Compromised integrations may expose repositories, deployment workflows, or related secrets.
General mitigation guidance
Mitigation generally centers on making authentication state cryptographically protected, single-use, short-lived, and bound to the initiating session, user, and intended integration. Redirect handlers should reject missing, altered, replayed, expired, or contextually invalid state values before performing sensitive actions. Critical setup operations should require explicit authentication and authorization checks, use secure server-side session state where practical, and apply least-privilege permissions to connected GitHub applications. Reducing trust in client-controlled parameters and separating authentication from integration configuration further limits exposure.
How teams detect issues like this
Detection can include static analysis and code review for redirect handlers that accept state or identity parameters without integrity checks, session binding, expiration, replay protection, or authorization enforcement. Security tests can exercise missing, altered, duplicated, expired, and cross-session state values and verify that sensitive actions are rejected. Runtime monitoring may flag unusual GitHub App setup attempts, unexpected association changes, and repeated failed or inconsistent callback requests. Automated application-security review tools may help identify missing authentication controls.
