CVE-2026-55075High· 7.4▾ TwilightCoder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.5%
Two flaws in Coder's OIDC login chained into account takeover: email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the email_verified claim was only enforced when present as a boolean false so an absent or non-boolean claim was treated as verified.
An attacker who could authenticate at the configured OIDC provider with an email matching a victim's Coder account could log in as that victim and gain full access to their workspaces, templates and resources. This required OIDC authentication, attacker control of a matching email at the IdP and a victim account not yet linked to a different IdP subject.
The fix restricts the email fallback to first-time and legacy linking and defaults email_verified to false when the claim is absent or of an unexpected type.
The fix was backported to all supported release lines:
Configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.
Coder would like to thank Anthropic's Security Team (ANT-2026-22450) for independently disclosing this issue!
github.com/coder/coder/v2 >= 2.34.0, < 2.34.2github.com/coder/coder/v2 >= 2.33.0, < 2.33.8github.com/coder/coder/v2 >= 2.30.0, < 2.32.7github.com/coder/coder/v2 < 2.29.17Upgrade to a patched release:
github.com/coder/coder/v2 2.34.2github.com/coder/coder/v2 2.33.8github.com/coder/coder/v2 2.32.7github.com/coder/coder/v2 2.29.17Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55076High· 7.4Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
CVE-2024-27918High· 8.2Coder's OIDC authentication allows email with partially matching domain to register
GHSA-8fxq-53rx-ph5fLow· 3.7Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison
GHSA-h58c-xccx-75m3Low· 3.4Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings
GHSA-qrwj-vh9x-gw5vHigh· 8.3Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write
CVE-2026-55077High· 7.2Coder: User-admin role can reset owner account password