CVE-2026-55075
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In Coder before versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in the OIDC login mechanism chain into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject, and the `email_verified` claim was only enforced when present as a boolean `false`, so an absent or non-boolean claim was treated as verified.
Risk Assessment
An attacker can take over a user account by using a fake email or an unverified claim, leading to unauthorized access to development environments and potential data leakage.
Recommendation
Immediately update Coder to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2. As a temporary workaround, configure the OIDC provider to disallow self-registration or require email verification before issuing tokens.
Original NVD description (English source)
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean `false` so an absent or non-boolean claim was treated as verified. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 restricts the email fallback to first-time and legacy linking and defaults `email_verified` to false when the claim is absent or of an unexpected type. As a workaround, configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.