Coder CVE-2026-55076
HIGH
GHSA-75vm-6w67-gwvp
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network OIDC flow with no Coder auth (PR:N) and no user interaction; AC:H because it depends on a non-conformant IdP and a pre-existing victim account; account takeover yields C:H/I:H, no availability impact.
Primary rating from Vendor (https://github.com/coder/coder).
CVSS VectorVendor: https://github.com/coder/coder
Lifecycle Timeline
2DescriptionCVE.org
Summary
Coder's OIDC callback checked email_verified with a direct Go bool type assertion. When an IdP returned the claim as a non-boolean (for example the string "false") or omitted it, the assertion failed open and the email was treated as verified. Combined with an unconditional email-based account fallback, this enabled account takeover.
Impact
An attacker who registered a victim's email at a compatible IdP without verifying it could log in via OIDC and be matched to the victim's existing Coder account, receiving a session for that account. No prior authentication to Coder was required and the result was full account takeover.
Patches
The fix coerces email_verified across bool, string and numeric types (fail-closed) and blocks the email fallback when the matched user already has a different linked IdP subject.
The fix was backported to all supported release lines:
Workarounds
Ensure the IdP returns email_verified as a native JSON boolean. The email-fallback linking issue has no configuration workaround; upgrading is required.
Resources
- Fix: #25712, #25713
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22444) for independently disclosing this issue!
AnalysisAI
Account takeover in Coder's OIDC login flow allows an unauthenticated remote attacker to hijack an existing user account by registering the victim's email at a compatible identity provider. A Go bool type assertion on the email_verified claim failed open when an IdP returned the claim as a non-boolean (e.g. the string "false") or omitted it entirely, and an unconditional email-based account fallback then matched the attacker's session to the victim's account. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was privately disclosed by Anthropic's Security Team and fixed across all supported release lines.
Technical ContextAI
Coder is a self-hosted platform for provisioning cloud development workspaces (distributed as the Go module github.com/coder/coder/v2) and supports OpenID Connect (OIDC) single sign-on. During the OIDC callback, the server validated the email_verified claim using a direct Go type assertion to bool; per OIDC spec this claim SHOULD be a native JSON boolean, but non-conformant IdPs may emit it as a string ("true"/"false") or numeric value. When the assertion failed (wrong type or claim absent), the code fell through in a way that treated the email as verified rather than rejecting it - a classic fail-open error. This maps to CWE-287 (Improper Authentication): the trust decision hinged on an unreliable claim parse, and a separate unconditional email-to-account fallback then linked the OIDC identity to any pre-existing local account sharing that email address, bypassing the intended IdP-subject binding.
RemediationAI
Upgrade to a patched release for your line: v2.34.2 (2.34), v2.33.8 (2.33), v2.32.7 (2.32), or v2.29.17 (2.29 ESR) - the fix coerces email_verified across bool, string and numeric types with fail-closed semantics and blocks the email fallback when the matched user already has a different linked IdP subject. As a partial interim measure, ensure your identity provider returns email_verified as a native JSON boolean, which closes the type-assertion vector; note this does NOT address the unconditional email-fallback account-linking weakness, for which upgrading is the only remediation. Release notes and the advisory are at https://github.com/coder/coder/security/advisories/GHSA-75vm-6w67-gwvp with fixes tracked in PRs #25712 and #25713.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today