CVE-2026-55076: Coder Authentication Bypass Vulnerability

CVE-2026-55076 Overview

Coder is a platform that lets organizations provision remote development environments via Terraform. A flaw in the OpenID Connect (OIDC) callback handler allows attackers to bypass email verification and take over accounts through an email-based fallback linking mechanism. The vulnerability affects Coder versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2. An Identity Provider (IdP) returning the email_verified claim as a non-boolean value causes a Go type assertion to fail open, treating unverified emails as verified. This weakness is classified as Improper Authentication [CWE-287].

Critical Impact
Network-based attackers can hijack existing Coder accounts by exploiting a fail-open OIDC email verification check combined with unconditional email-based account linking.

Affected Products

Coder versions prior to 2.29.7
Coder versions prior to 2.32.7 and 2.33.8
Coder versions prior to 2.34.2

Discovery Timeline

2026-07-07 - CVE-2026-55076 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55076

Vulnerability Analysis

The vulnerability resides in Coder's OIDC callback handler, which validates the email_verified claim returned by the Identity Provider. Coder uses a direct Go bool type assertion to read this claim from the OIDC token. When an IdP returns email_verified as a JSON string like "false", a numeric value, or omits the claim entirely, the type assertion fails and returns the zero value without raising an error.

The callback then proceeds as if the email were verified. Coder combines this check with an unconditional email-based account lookup, which links the incoming OIDC identity to any local user matching the supplied email address. This chain of behavior converts a claim-parsing weakness into a full account takeover primitive.

Root Cause

The root cause is unsafe deserialization of an untrusted claim combined with permissive account linking. The Go type assertion pattern claim.(bool) silently produces false when the underlying type differs, rather than signaling a parse error. The email-fallback linking logic then trusts the caller-provided email without verifying that the OIDC subject matches any existing linked identity for that user.

Attack Vector

An attacker who controls or influences an IdP response, or who registers with an IdP that emits email_verified in a non-boolean format, can supply the target victim's email in the OIDC claims. The Coder server treats the email as verified and links the attacker's OIDC subject to the victim's existing account, granting login access. The attack requires no authentication to the Coder instance and no user interaction from the victim.

See the GitHub Security Advisory GHSA-75vm-6w67-gwvp for the maintainer's technical description.

Detection Methods for CVE-2026-55076

Indicators of Compromise

Coder audit log entries showing OIDC account linking events where the OIDC subject for a user changes unexpectedly.
Successful OIDC logins for accounts that previously authenticated through a different IdP subject identifier.
Login events originating from IdPs that emit email_verified as a string or omit the claim entirely.

Detection Strategies

Review Coder server logs for OIDC callback flows that resulted in new subject-to-user linkages against pre-existing accounts.
Correlate OIDC login timestamps with password reset, workspace creation, or Terraform template modification events to identify follow-on activity.
Inspect IdP token responses in traffic captures or IdP-side logs to confirm the format of the email_verified claim.

Monitoring Recommendations

Alert on any Coder user whose linked OIDC subject changes without a corresponding administrative action.
Monitor for logins from unusual geographic locations or new client IPs against privileged Coder accounts.
Track outbound access from Coder-provisioned workspaces for signs of post-takeover lateral movement.

How to Mitigate CVE-2026-55076

Immediate Actions Required

Upgrade Coder to 2.29.7, 2.32.7, 2.33.8, or 2.34.2 or later immediately.
Audit existing OIDC-linked accounts to confirm the current subject identifier matches an expected user.
Rotate active Coder sessions and API tokens for any accounts flagged during the audit.

Patch Information

The fix, delivered in pull request #25712 and pull request #25713, coerces email_verified across bool, string, and numeric types with fail-closed semantics. It also blocks the email fallback when the matched user already has a different linked IdP subject. Patched builds are available in v2.29.17, v2.32.7, v2.33.8, and v2.34.2.

Workarounds

Configure the IdP to always emit email_verified as a native JSON boolean value.
Restrict Coder OIDC configuration to trusted IdPs that enforce strict claim typing.
No configuration workaround exists for the email-fallback linking behavior; upgrading is required to fully remediate.

bash

# Verify running Coder version and upgrade
coder version
# Upgrade example for a systemd-based install
sudo systemctl stop coder
sudo curl -fsSL https://coder.com/install.sh | sh -s -- --version 2.34.2
sudo systemctl start coder