Coder CVE-2026-55075
HIGH
GHSA-9r87-mvcw-x35f
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network OIDC flow (AV:N) with no Coder privileges (PR:N) or interaction, but AC:H because the attacker must control a matching unverified email and the victim must be unlinked; full account takeover gives C:H/I:H, no availability impact.
Primary rating from Vendor (https://github.com/coder/coder).
CVSS VectorVendor: https://github.com/coder/coder
Lifecycle Timeline
2DescriptionCVE.org
Summary
Two flaws in Coder's OIDC login chained into account takeover: email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the email_verified claim was only enforced when present as a boolean false so an absent or non-boolean claim was treated as verified.
Impact
An attacker who could authenticate at the configured OIDC provider with an email matching a victim's Coder account could log in as that victim and gain full access to their workspaces, templates and resources. This required OIDC authentication, attacker control of a matching email at the IdP and a victim account not yet linked to a different IdP subject.
Patches
The fix restricts the email fallback to first-time and legacy linking and defaults email_verified to false when the claim is absent or of an unexpected type.
The fix was backported to all supported release lines:
Workarounds
Configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.
Resources
- Fix: #25712, #25713
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22450) for independently disclosing this issue!
AnalysisAI
Account takeover in Coder's OIDC login (versions before v2.34.2, v2.33.8, v2.32.7, and ESR v2.29.17) lets an attacker who controls a matching email address at the configured identity provider log in as a victim and seize their workspaces, templates and resources. Two chained flaws are responsible: email-based user matching silently linked accounts by email without verifying an existing IdP-subject link, and the email_verified claim was only honored when explicitly boolean false, so absent or malformed claims were treated as verified. CVSS is 7.4 (High) with no public exploit identified at time of analysis; the issue was privately reported by Anthropic's Security Team.
Technical ContextAI
Coder is a self-hosted platform that provisions cloud development environments (workspaces) from templates, commonly authenticating operators via OpenID Connect (OIDC) federation. The root cause maps to CWE-287 (Improper Authentication): during OIDC login, Coder resolves the incoming identity to a local user. The first defect is in email-based user matching, which fell back to linking a token to an existing Coder account by email address alone without checking whether that account was already bound to a different IdP subject (the stable 'sub' identifier). The second defect is trust enforcement on the email_verified claim, which was only rejected when present as boolean false - an absent claim or one of an unexpected type (string, null, number) bypassed the check and was treated as verified. The affected code is the Go module github.com/coder/coder/v2, per the CPE data.
RemediationAI
Vendor-released patches are available: upgrade to Coder v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR) depending on your release line - the fix restricts the email fallback to first-time and legacy linking and defaults email_verified to false when the claim is absent or of an unexpected type. Download links are on the GitHub releases pages (e.g. https://github.com/coder/coder/releases/tag/v2.34.2) and the fixes are tracked in PRs #25712 (https://github.com/coder/coder/pull/25712) and #25713 (https://github.com/coder/coder/pull/25713). If immediate patching is not possible, apply the vendor workarounds: configure the OIDC provider to disallow self-registration, or require verified email before issuing tokens; the trade-off is that disabling self-registration forces manual/pre-provisioned account creation and enforced email verification may add friction to legitimate onboarding, but both directly break the two preconditions this attack relies on.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today