Authentication Bypass Vulnerability in Coder Remote Development Environments
CVE-2026-55076
What is CVE-2026-55076?
The vulnerability allows unauthorized account access due to improper verification of the email_verified claim during OIDC callback in Coder's remote development environments. When IdP returns a non-boolean value for the email_verified claim, the system fails to validate the user's email accurately, thereby treating it as verified. This flaw, combined with an automatic fallback mechanism for email-based accounts, exposes organizations to potential account takeover. Upgrading to the latest versions is essential to mitigate this risk, as the fix includes reinforcement of value type checks and blocks unsafe email fallback usage.
Affected Version(s)
coder >= 2.34.0, < 2.34.2 < 2.34.0, 2.34.2
coder >= 2.33.0, < 2.33.8 < 2.33.0, 2.33.8
coder >= 2.30.0, < 2.32.7 < 2.30.0, 2.32.7