Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-55075Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

High 7.4

In plain English

A high-severity improper authentication in coder from coder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.5%top 58.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean `false` so an absent or non-boolean claim was treated as verified. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 restricts the email fallback to first-time and legacy linking and defaults `email_verified` to false when the claim is absent or of an unexpected type. As a workaround, configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/coder/coder	no fix listed	GO-2026-5908
Go	github.com/coder/coder/v2	2.29.17, 2.32.7, 2.33.8, 2.34.2	GO-2026-5908
Go	github.com/coder/coder/v2	2.34.2	GHSA-9r87-mvcw-x35f
Go	github.com/coder/coder/v2	2.33.8	GHSA-9r87-mvcw-x35f
Go	github.com/coder/coder/v2	2.32.7	GHSA-9r87-mvcw-x35f
Go	github.com/coder/coder/v2	2.29.17	GHSA-9r87-mvcw-x35f

Affected products (as reported)

Vendor	Product	Versions
coder	coder	>= 2.34.0, < 2.34.2>= 2.33.0, < 2.33.8>= 2.30.0, < 2.32.7< 2.29.17

Weakness: CWE-287, CWE-289 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/coder/coder/security/advisories/GHSA-9r87-mvcw-x35f x_refsource_CONFIRM
https://github.com/coder/coder/pull/25712 x_refsource_MISC
https://github.com/coder/coder/pull/25713 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.29.17 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.32.7 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.33.8 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.34.2 x_refsource_MISC