CVE-2026-55076 Details
Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked `email_verified` with a direct Go `bool` type assertion. When an IdP returned the claim as a non-boolean (for example the string `"false"`) or omitted it, the assertion failed open and the email was treated as verified. Combined with an unconditional email-based account fallback, this enabled account takeover. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 coerces `email_verified` across bool, string and numeric types (fail-closed) and blocks the email fallback when the matched user already has a different linked IdP subject. As a workaround, ensure the IdP returns `email_verified` as a native JSON boolean. The email-fallback linking issue has no configuration workaround; upgrading is required.
A vulnerability in Coder's OpenID Connect (OIDC) implementation prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, allows for account takeover by improperly handling the 'email_verified' claim. The OIDC callback relied on a direct boolean type assertion. If an Identity Provider (IdP) returned the claim as a non-boolean value, such as the string 'false', or omitted it altogether, the assertion failed open, erroneously validating the email as verified. This flaw, combined with an unconditional fallback to email-based account linking, enabled attackers to take over accounts. Exploitation involved registering an unverified email with a compatible IdP and then logging in via OIDC, thereby gaining access to the victim's Coder account without prior authentication.
Users can upgrade to Coder versions 2.29.17, 2.32.7, 2.33.8, or 2.34.2. Instructions for upgrading Coder are available in the Coder documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coder/coder/pull/25712 | [email protected] | Issue TrackingPatch |
| https://github.com/coder/coder/pull/25713 | [email protected] | Issue TrackingPatch |
| https://github.com/coder/coder/releases/tag/v2.29.17 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.32.7 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.33.8 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.34.2 | [email protected] | Release Notes |
| https://github.com/coder/coder/security/advisories/GHSA-75vm-6w67-gwvp | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-704 | Incorrect Type Conversion or Cast | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coder coder | < 2.29.17 >= 2.30.0, < 2.32.7 >= 2.33.0, < 2.33.8 >= 2.34.0, < 2.34.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |