Coder CVE-2025-71435

Exploitation requires a specific configuration chain: (1) Coder authentication must use OIDC, and (2) the OpenID Identity Provider must NOT return a refresh token (or refresh tokens are not issued/disabled), since the bypass does not occur when a refresh token is present and refresh is enforced. The attacker must already be an authenticated Coder user (PR:L) holding a valid APIKey cookie, and must continue using Coder at least once per 24-hour window to keep the cookie's lifetime auto-extending. LIMITING FACTORS: the APIKey lifetime-extension behavior can be disabled by configuration, which removes the indefinite-access property; the flaw grants no new access to an attacker who never had a valid session; and it depends entirely on the IdP's refresh-token behavior, making it a non-default, deployment-specific condition rather than a universally exploitable flaw.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The CVSS 4.0 base score is 2.3 (Low), reflecting a weak impact profile (VC:L/VI:L/VA:N, no subsequent-system impact) and - critically - an Attack Requirement (AT:P) that mirrors the real precondition: the OIDC Identity Provider must not issue a refresh token. Privileges Required is Low (PR:L), meaning the attacker is already an authenticated Coder user, so this is a privilege/session-retention issue rather than an initial-access break. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied; there is no public exploit identified at time of analysis, and no evidence of active exploitation. The impact is bounded: a user who has lost OIDC authorization can continue using Coder beyond the IdP token expiry, but they must already possess a valid Coder session and cannot gain new access or elevate privileges. The absence of EPSS/KEV/POC data is expected for a low-severity, recently disclosed flaw and should not be read as a gap that hides higher risk - the vulnerability class (CWE-613, insufficient session expiration) and vendor description both point to a limited, access-continuity problem. Vendor advisory (GHSA-3rw9-wmc8-8948) and VulnCheck confirm the mechanism and the fix.

An employee logs into Coder via OIDC against an identity provider that does not return a refresh token (or where refresh tokens are disabled). After the employee is deprovisioned or loses OIDC authorization, their Coder APIKey cookie remains valid; by simply using Coder at least once within each 24-hour window, the cookie's lifetime keeps extending, letting them access the service indefinitely despite no longer being authorized. No public exploit code is required - the bypass occurs through normal, continued use of the existing session.