CVE-2026-55075: Coder OIDC Authentication Bypass Flaw

CVE-2026-55075 Overview

Coder is a platform that provisions remote development environments via Terraform. CVE-2026-55075 describes two chained flaws in Coder's OpenID Connect (OIDC) login flow that enable account takeover. Email-based user matching fell back to linking accounts by email without verifying an existing link to a different Identity Provider (IdP) subject. In parallel, the email_verified claim was only enforced when explicitly set to boolean false, so an absent or non-boolean claim was treated as verified. The combination allows an attacker controlling an IdP or an account at a permissive IdP to hijack existing Coder accounts. The issue is fixed in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2.

Critical Impact
Chained OIDC flaws allow attackers to link arbitrary IdP identities to existing Coder accounts, resulting in full account takeover and access to remote development environments.

Affected Products

Coder versions prior to 2.29.7
Coder versions prior to 2.32.7 and 2.33.8
Coder versions prior to 2.34.2

Discovery Timeline

2026-07-07 - CVE-2026-55075 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55075

Vulnerability Analysis

CVE-2026-55075 is an Authentication Bypass issue [CWE-287] affecting Coder's OIDC login handler. Two independent defects combine to permit account takeover. The first defect changes the account-linking behavior: when a user logs in through OIDC, Coder falls back to matching by email address. That fallback does not check whether the local account is already linked to a different IdP subject identifier. An attacker who can present a token with a victim's email address can therefore be linked to the victim's existing Coder account.

The second defect weakens the trust boundary on the email claim. Coder only rejected the login when the email_verified claim was present as boolean false. An absent claim, a string value, or any other unexpected type was silently treated as verified. Together, the flaws let an attacker with control over an IdP, or an account at an IdP that does not enforce email verification, assert an arbitrary email and complete the linking step.

Root Cause

The root cause is improper validation of OIDC identity claims. The email fallback path lacked an existing-link check against the IdP subject, and the email_verified handler used insecure defaults for missing or malformed claim values.

Attack Vector

Exploitation is network based and requires no user interaction on the victim side. The attacker authenticates through an OIDC provider trusted by the Coder deployment, asserts the victim's email address, and relies on the missing email_verified enforcement to bypass verification. Coder then links the attacker's IdP subject to the victim's account, granting the attacker the victim's role and workspace access.

No verified exploitation code is public. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-9r87-mvcw-x35f and the fix commits in Pull Request #25712 and Pull Request #25713.

Detection Methods for CVE-2026-55075

Indicators of Compromise

Audit log entries showing an existing user account linked to a new OIDC subject identifier that differs from the previously recorded subject.
OIDC login events where the email_verified claim is absent, null, or a non-boolean type.
Successful logins followed by workspace creation or SSH key changes from unfamiliar source addresses.
Multiple OIDC identities resolving to the same Coder user record in a short window.

Detection Strategies

Compare the OIDC sub claim recorded at first login against the sub presented on subsequent logins for the same user, and alert on mismatches.
Parse OIDC ID tokens ingested from application logs and flag tokens missing the email_verified claim or containing non-boolean values.
Correlate authentication events with workspace, template, and permission changes performed within the following session.

Monitoring Recommendations

Forward Coder application and audit logs to a centralized logging or SIEM platform for retention and query.
Baseline expected IdP issuers and reject or alert on tokens from unexpected issuers or client IDs.
Monitor Coder release channels and container image tags for versions below 2.29.7, 2.32.7, 2.33.8, and 2.34.2.

How to Mitigate CVE-2026-55075

Immediate Actions Required

Upgrade Coder to 2.29.7, 2.32.7, 2.33.8, or 2.34.2 depending on the deployed release line.
Review the OIDC user-to-subject mapping table and investigate any account whose linked subject changed after the vulnerable window.
Rotate session tokens and API keys for users whose OIDC linkage cannot be verified as legitimate.

Patch Information

The fix restricts the email fallback to first-time and legacy linking only and defaults email_verified to false when the claim is absent or of an unexpected type. Patched releases are available at Coder v2.29.17, Coder v2.32.7, Coder v2.33.8, and Coder v2.34.2. Code changes are documented in Pull Request #25712 and Pull Request #25713.

Workarounds

Configure the OIDC provider to disallow self-registration so attackers cannot create accounts with arbitrary email addresses.
Require email verification at the IdP before it issues tokens, ensuring the email_verified claim is always present and truthful.
Restrict the OIDC application to a single trusted issuer and enforce allowlisted email domains at the provider level.

bash

# Configuration example
# Verify installed Coder version and upgrade if below the fixed releases
coder version
# Example upgrade using the official install script
curl -L https://coder.com/install.sh | sh -s -- --version 2.34.2