CVE-2025-71435: Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
Coder deployments running versions before 2.23.0 are affected when they use OIDC authentication and the OIDC provider does not issue refresh tokens. The issue concerns authenticated users retaining access after their OIDC authorization expires.
What does an attacker need to exploit the vulnerability?
The attacker must already be an authenticated Coder user with an active APIKey cookie. They must continue using Coder regularly so the cookie is extended every 24 hours after the associated OIDC token has expired.
Does the issue require user interaction or unauthenticated access?
No. Exploitation does not require additional user interaction, but it does require low-privileged authenticated access. The provided vector identifies network access, high attack complexity, and low privileges required.
What can be done if upgrading is not immediately possible?
The provided information does not specify a workaround. Because the issue depends on OIDC deployments that do not issue refresh tokens, review whether affected users can retain active APIKey cookies after OIDC authorization is revoked or expires.