CVE-2025-22610 Coolify Vulnerable to OAuth Secrets Leak

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the global coolify instance OAuth configuration. This exposes the "client id" and "client secret" f...

CVE-2025-22607 Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the details page for any GitHub / GitLab configuration on a Coolify instance by only knowing the UU...

CVE-2025-22607 Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the details page for any GitHub / GitLab configuration on a Coolify instance by only knowing the UU...

Malicious code in lyft-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 58c0d486a0a319a7ba6fbad3e5c15fe0bbf6966cac7c5a7f3ebee46c2c7f8bb7 The OpenSSF Package Analysis project identified 'lyft-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-561 Malicious code in lyft-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 58c0d486a0a319a7ba6fbad3e5c15fe0bbf6966cac7c5a7f3ebee46c2c7f8bb7 The OpenSSF Package Analysis project identified 'lyft-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-503 Malicious code in instacart-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bcb0165ac8368409888b3738226fa768c188f411130de11329b6642118e4e5dd The OpenSSF Package Analysis project identified 'instacart-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in epicagames-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 815d1b3f4d854d1b3d87eb9ba56d9f818ed9eb6ca84b999f97329b69ff8eec22 The OpenSSF Package Analysis project identified 'epicagames-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-449 Malicious code in epicagames-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 815d1b3f4d854d1b3d87eb9ba56d9f818ed9eb6ca84b999f97329b69ff8eec22 The OpenSSF Package Analysis project identified 'epicagames-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in dropbox-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 354ecda67f801f9b4cc23fae184e1fd2632d0c6970bb7d4190c00c514816a80f The OpenSSF Package Analysis project identified 'dropbox-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-431 Malicious code in dropbox-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 354ecda67f801f9b4cc23fae184e1fd2632d0c6970bb7d4190c00c514816a80f The OpenSSF Package Analysis project identified 'dropbox-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in amazon-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e6c3c7c427f25937801f54534b488f10721cf11e43e122f0f00a47350ba80c2c The OpenSSF Package Analysis project identified 'amazon-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-384 Malicious code in amazon-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e6c3c7c427f25937801f54534b488f10721cf11e43e122f0f00a47350ba80c2c The OpenSSF Package Analysis project identified 'amazon-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in coinbase-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a5ca839941ed94b22736187227b12ba68ef04a39c55e4155add495e004d8ed43 The OpenSSF Package Analysis project identified 'coinbase-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-420 Malicious code in coinbase-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a5ca839941ed94b22736187227b12ba68ef04a39c55e4155add495e004d8ed43 The OpenSSF Package Analysis project identified 'coinbase-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in bookingcom-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a8735f282a15b5745e75f0bccc4b1334d5c464523d1267ed916477c461cd8b8c The OpenSSF Package Analysis project identified 'bookingcom-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-402 Malicious code in bookingcom-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a8735f282a15b5745e75f0bccc4b1334d5c464523d1267ed916477c461cd8b8c The OpenSSF Package Analysis project identified 'bookingcom-oauth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

PT-2025-4596 · Coolify · Coolify

Name of the Vulnerable Software and Affected Versions: Coolify versions prior to 4.0.0-beta.361 Description: The issue is related to missing authorization, allowing any authenticated user to access and modify the global Coolify instance OAuth configuration. This exposes sensitive information,...

CVE-2025-22610: Missing Authorization

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the global coolify instance OAuth configuration. This exposes the "client id" and "client secret" f...

GHSA-QJW6-XVRM-5F2H Bitbucket Server Integration Plugin allows bypassing CSRF protection for any URL

An extension point in Jenkins allows selectively disabling cross-site request forgery CSRF protection for specific URLs. Bitbucket Server Integration Plugin implements this extension point to support OAuth 1.0 authentication. In Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 both inclusi...

atlassian-bitbucket-server-integration allows bypassing CSRF protection for any URL

An extension point in Jenkins allows selectively disabling cross-site request forgery CSRF protection for specific URLs. atlassian-bitbucket-server-integration implements this extension point to support OAuth 1.0 authentication. In atlassian-bitbucket-server-integration 2.1.0 through 4.1.3 both...