Session Expiration Bypass Vulnerability in Coder Software by Coder

CVE-2025-71435

What is CVE-2025-71435?

The Coder platform, prior to version 2.23.0, is susceptible to a session expiration bypass that compromises user security. This vulnerability permits authenticated users to maintain access to the platform even after the OIDC token has expired, provided no refresh token is engaged. The flaw arises because users can keep their APIKey cookie active through consistent usage, effectively extending their session every 24 hours. This flaw poses significant risks as it allows continued access to resources without proper authorization checks once the OIDC token is no longer valid.

References