Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-55076Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

High 7.4

In plain English

A high-severity improper authentication in coder from coder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.6%top 50.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked `email_verified` with a direct Go `bool` type assertion. When an IdP returned the claim as a non-boolean (for example the string `"false"`) or omitted it, the assertion failed open and the email was treated as verified. Combined with an unconditional email-based account fallback, this enabled account takeover. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 coerces `email_verified` across bool, string and numeric types (fail-closed) and blocks the email fallback when the matched user already has a different linked IdP subject. As a workaround, ensure the IdP returns `email_verified` as a native JSON boolean. The email-fallback linking issue has no configuration workaround; upgrading is required.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/coder/coder	no fix listed	GO-2026-5907
Go	github.com/coder/coder/v2	2.29.17, 2.32.7, 2.33.8, 2.34.2	GO-2026-5907
Go	github.com/coder/coder/v2	2.34.2	GHSA-75vm-6w67-gwvp
Go	github.com/coder/coder/v2	2.33.8	GHSA-75vm-6w67-gwvp
Go	github.com/coder/coder/v2	2.32.7	GHSA-75vm-6w67-gwvp
Go	github.com/coder/coder/v2	2.29.17	GHSA-75vm-6w67-gwvp

Affected products (as reported)

Vendor	Product	Versions
coder	coder	>= 2.34.0, < 2.34.2>= 2.33.0, < 2.33.8>= 2.30.0, < 2.32.7< 2.29.17

Weakness: CWE-287, CWE-704 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/coder/coder/security/advisories/GHSA-75vm-6w67-gwvp x_refsource_CONFIRM
https://github.com/coder/coder/pull/25712 x_refsource_MISC
https://github.com/coder/coder/pull/25713 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.29.17 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.32.7 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.33.8 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.34.2 x_refsource_MISC