CVE-2026-27882

The record

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.461, the GitLab webhook endpoint uses a non-constant-time string comparison operator (!==) to validate the webhook secret token. This implementation is vulnerable to timing attacks, which could allow an attacker to gradually discover the secret token by measuring response time differences. This vulnerability is fixed in 4.0.0-beta.461.

Affected packages

Related vulnerabilities

• CVE-2026-63410 secp256k1-native is a native C secp256k1 implementation for Ruby. CWE-208
• CVE-2026-62860 Picsou is a self-hosted personal finance dashboard. CWE-208
• CVE-2026-93434 An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process… CWE-208
• CVE-2026-65630 Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a… CWE-208
• CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
• CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208
• CVE-2026-77696 Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret… CWE-208
• CVE-2026-54875 Issue summary: A non-constant-time optimized implementation of scalar point… CWE-208