CVE-2026-55435: Coder Auth Bypass Vulnerability

CVE-2026-55435 Overview

Coder is a platform that provisions remote development environments through Terraform. CVE-2026-55435 is an authorization flaw [CWE-863] in Coder's AI Bridge proxy endpoints. The Server.IsAuthorized function in coderd/aibridgedserver validates key format, expiry, secret, and checks for deleted or system users. It does not check whether the account is suspended. Because suspension does not revoke existing API keys, a suspended user's unexpired token continues working against AI Bridge endpoints. The issue affects Coder versions 2.30.0 through the fixes in 2.32.7, 2.33.8, and 2.34.2.

Critical Impact
Suspended Coder users retain access to AI Bridge proxy endpoints through previously issued API keys, defeating administrative suspension until each key is manually deleted.

Affected Products

Coder versions 2.30.0 up to 2.32.7
Coder versions 2.31.0 up to 2.33.8
Coder versions 2.34.0 up to 2.34.2

Discovery Timeline

2026-07-07 - CVE-2026-55435 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-55435

Vulnerability Analysis

The flaw resides in the AI Bridge authentication path implemented in coderd/aibridgedserver. When a request reaches an AI Bridge proxy endpoint, the server calls Server.IsAuthorized to validate the presented API key. The function returns typed errors for expired keys, unknown users, deleted users, and system users. It does not return an error when the associated user account is suspended. Administrators expect suspension to immediately cut off access. Instead, the account's outstanding API keys remain functional against AI Bridge until an operator explicitly deletes them. The scope is bounded: a suspended account cannot mint new keys, and the impact ends when existing keys expire or are revoked.

Root Cause

The root cause is missing authorization state validation [CWE-863]. The authentication routine treats key validity and user existence as sufficient, but omits the account status check for suspended. Coder's suspension workflow disables login and prevents token issuance, yet leaves previously minted keys in the database. Combined, these two gaps produce an authorization bypass restricted to the AI Bridge surface.

Attack Vector

Exploitation requires an attacker to already hold a valid, unexpired API key from a Coder user before that user is suspended. After suspension, the attacker sends requests to AI Bridge proxy endpoints using the retained key. Requests pass IsAuthorized and reach the AI proxy backend. This is a post-suspension persistence issue rather than an unauthenticated remote flaw.

// Patch: coderd/aibridgedserver/aibridgedserver.go
// Source: https://github.com/coder/coder/commit/0d2c9f904a8b75b888140fcc8fbf4633660cc787
	ErrExpired       = xerrors.New("expired")
	ErrUnknownUser   = xerrors.New("unknown user")
	ErrDeletedUser   = xerrors.New("deleted user")
+	ErrInactiveUser  = xerrors.New("inactive user")
	ErrSystemUser    = xerrors.New("system user")
	ErrAmbiguousAuth = xerrors.New("both key and key_id set; exactly one required")

The patch introduces ErrInactiveUser so IsAuthorized rejects tokens tied to suspended accounts. See the GitHub commit and pull request #26173.

Detection Methods for CVE-2026-55435

Indicators of Compromise

Successful authenticated requests to /aibridge or AI Bridge proxy endpoints originating from API keys tied to user accounts marked as suspended in the Coder database.
API key usage timestamps that continue advancing after a user's suspended_at timestamp is set.
Access-token audit events referencing suspended user IDs against coderd/aibridgedserver handlers.

Detection Strategies

Correlate Coder audit logs for user suspension events with subsequent API access records for the same user_id.
Query the Coder database for API keys whose user_id maps to a user with status = 'suspended' and last_used after the suspension timestamp.
Alert on any non-zero call volume to AI Bridge endpoints from accounts that appear in suspension audit entries.

Monitoring Recommendations

Ingest Coder application and audit logs into a centralized logging or SIEM platform and build a rule matching suspended-user API key activity.
Monitor the output of GET /api/v2/users?status=suspended alongside API key inventory to identify orphaned tokens.
Track outbound calls from Coder to upstream AI providers and flag traffic attributed to suspended principals.

How to Mitigate CVE-2026-55435

Immediate Actions Required

Upgrade Coder to version 2.32.7, 2.33.8, or 2.34.2 depending on the release train currently deployed.
Enumerate all currently suspended users and delete their outstanding API keys before or immediately after upgrade.
Review AI Bridge access logs for the past 90 days to identify any use by suspended accounts.

Patch Information

Coder released fixes in v2.32.7, v2.33.8, and v2.34.2. The upstream fix is tracked in GHSA-wqxv-w64v-5wh6 and merged via pull request #26164 and pull request #26173. The patch adds an ErrInactiveUser check to Server.IsAuthorized so suspended accounts fail authorization at the AI Bridge boundary.

Workarounds

On any user suspension, immediately call DELETE /api/v2/users/{user}/keys to revoke that user's API keys.
Automate key revocation in your identity provisioning workflow so suspension events trigger the delete-keys endpoint.
Rotate long-lived Coder API tokens and shorten default token lifetimes to reduce the persistence window for suspended-account keys.

bash

# Revoke all API keys for a suspended Coder user
CODER_URL="https://coder.example.com"
SESSION_TOKEN="<admin-session-token>"
USER="suspended-user-id-or-username"

curl -X DELETE \
  -H "Coder-Session-Token: ${SESSION_TOKEN}" \
  "${CODER_URL}/api/v2/users/${USER}/keys"