CVE-2026-55075 Details

A vulnerability in Coder's OpenID Connect (OIDC) login process allowed for account takeover. This issue was present in Coder versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2. The vulnerability arose because the email-based user matching process improperly linked accounts by email without verifying if they were already connected to a different identity provider (IdP) subject. Additionally, the 'email_verified' claim was only enforced when it explicitly indicated 'false', allowing an absent or non-boolean claim to be mistakenly considered verified. Exploitation required an attacker to authenticate with an OIDC provider using an email that matched a victim's Coder account, and the victim's account had to be unlinked from another IdP subject.

Users can upgrade to Coder versions 2.29.17, 2.32.7, 2.33.8, or 2.34.2, all of which include the necessary fix. Instructions for upgrading Coder are available in the Coder documentation. As an additional step, OIDC providers can be configured to disallow self-registration or to require email verification before issuing tokens.