CVE-2026-55076
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked email_verified with a direct Go bool type assertion. When an IdP returned the claim as a non-boolean (for example the string "false") or omitted it, the assertion failed open and the email was treated as verified. Combined with an unconditional email-based account fallback, this enabled account takeover. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 coerces email_verified across bool, string and numeric types (fail-closed) and blocks the email fallback when the matched user already has a different linked IdP subject. As a workaround, ensure the IdP returns email_verified as a native JSON boolean. The email-fallback linking issue has no configuration workaround; upgrading is required.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| coder | coder | >= 2.34.0, < 2.34.2 | affected |
| coder | coder | >= 2.33.0, < 2.33.8 | affected |
| coder | coder | >= 2.30.0, < 2.32.7 | affected |
| coder | coder | < 2.29.17 | affected |
Weaknesses
- CWE-287: CWE-287: Improper Authentication
- CWE-704: CWE-704: Incorrect Type Conversion or Cast
References
- https://github.com/coder/coder/security/advisories/GHSA-75vm-6w67-gwvp
- https://github.com/coder/coder/pull/25712
- https://github.com/coder/coder/pull/25713
- https://github.com/coder/coder/releases/tag/v2.29.17
- https://github.com/coder/coder/releases/tag/v2.32.7
- https://github.com/coder/coder/releases/tag/v2.33.8
- https://github.com/coder/coder/releases/tag/v2.34.2
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.