CVE-2025-58437: Coder Authentication Bypass Vulnerability

CVE-2025-58437 Overview

Coder is a platform that provisions remote development environments using Terraform. CVE-2025-58437 is a session management vulnerability affecting Coder versions 2.22.0 through 2.24.3, 2.25.0, and 2.25.1. The flaw allows insecure session handling in prebuilt workspaces. When a prebuilt workspace is claimed by a user, Coder generates a new session token but fails to expire the previous token associated with the built-in prebuilds system user. Workspace templates that persist the auto-generated coder_workspace_owner.session_token therefore retain a valid token tied to the prebuilds account. The issue is tracked under [CWE-277] and [CWE-613] and is fixed in versions 2.24.4 and 2.25.2.

Critical Impact
An attacker who obtains a persisted prebuilds session token can authenticate as the privileged prebuilds system user, leading to unauthorized access to workspace resources and elevated platform actions.

Affected Products

Coder versions 2.22.0 through 2.24.3
Coder version 2.25.0
Coder version 2.25.1

Discovery Timeline

2025-09-06 - CVE-2025-58437 published to NVD
2025-10-17 - Last updated in NVD database

Technical Details for CVE-2025-58437

Vulnerability Analysis

Coder automatically generates a session token whenever a workspace starts. The token is exposed to Terraform templates through the coder_workspace_owner.session_token attribute. Prebuilt workspaces are initially owned by an internal prebuilds system user that holds elevated permissions for workspace provisioning.

When a user claims a prebuilt workspace, Coder issues a new session token tied to the claiming user. However, the previously issued token bound to the prebuilds system user remained valid. Any template that persisted coder_workspace_owner.session_token to disk, environment variables, or build artifacts retained a working credential for the privileged prebuilds account.

Root Cause

The root cause is improper session invalidation [CWE-613] combined with insecure inherited privileges [CWE-277]. The ownership-transfer code path regenerated the session token but never called an expiration routine for the outgoing prebuilds user's API key. The fix introduces an ExpirePrebuildsAPIKeys database operation invoked during token regeneration.

Attack Vector

An authenticated user who claims a prebuilt workspace, or who can read template state containing the persisted token, can extract the prebuilds session token and reuse it against the Coder API. Because the token authenticates as the prebuilds system user, the attacker gains access beyond the privileges of their own account.

// Patch: add ExpirePrebuildsAPIKeys to the authorized querier
// Source: https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276
func (q *querier) ExpirePrebuildsAPIKeys(ctx context.Context, now time.Time) error {
    if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceApiKey); err != nil {
        return err
    }
    return q.db.ExpirePrebuildsAPIKeys(ctx, now)
}

Source: GitHub Commit 06cbb28. The patch adds an authorization-gated function that expires API keys belonging to the prebuilds user when a workspace is claimed, ensuring stale tokens cannot be reused.

Detection Methods for CVE-2025-58437

Indicators of Compromise

API requests authenticated with a session token tied to the built-in prebuilds system user originating from workspace runtimes or user endpoints after a workspace claim event.
Long-lived API keys for the prebuilds user that remain active beyond the lifetime of the originating prebuilt workspace.
Template state, environment files, or build artifacts containing literal values of coder_workspace_owner.session_token.

Detection Strategies

Audit Coder's api_keys table for entries owned by the prebuilds system user and correlate creation timestamps with workspace claim events.
Review Terraform state files and provider logs for templates that read coder_workspace_owner.session_token and persist it to outputs, files, or environment variables.
Compare the Coder server version against the affected range (2.22.0–2.24.3, 2.25.0, 2.25.1) to identify exposed deployments.

Monitoring Recommendations

Enable and centralize Coder audit logs, then alert on API actions performed by the prebuilds user from unexpected source addresses.
Track API key creation and expiration events to detect tokens that outlive their owning workspace.
Monitor template repositories for new commits that reference session_token to catch unsafe patterns before they are deployed.

How to Mitigate CVE-2025-58437

Immediate Actions Required

Upgrade Coder to version 2.24.4 or 2.25.2, which include the ExpirePrebuildsAPIKeys fix.
Revoke all existing API keys owned by the prebuilds system user to invalidate any tokens leaked before patching.
Audit every workspace template and remove logic that writes coder_workspace_owner.session_token to persistent storage, outputs, or environment variables.

Patch Information

The vendor released fixes in Coder 2.24.4 and 2.25.2. The relevant changes are documented in GitHub Security Advisory GHSA-j6xf-jwrj-v5qp and implemented across Pull Request #19667, Pull Request #19668, and Pull Request #19669. The core change adds a query to expire prebuilds-owned API keys at the moment a new session token is regenerated for the claiming user.

Workarounds

Modify templates so that coder_workspace_owner.session_token is consumed only in memory and never written to files, outputs, or container layers.
Manually expire prebuilds API keys after each workspace claim until upgrading is possible.
Restrict who can author or modify Coder templates so untrusted users cannot introduce code paths that exfiltrate session tokens.

bash

# Upgrade Coder server to a patched release
# Replace <version> with 2.24.4 or 2.25.2 depending on your branch
curl -fsSL https://coder.com/install.sh | sh -s -- --version <version>

# Verify the installed version
coder --version