CVE-2026-55075: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
Summary
Two flaws in Coder's OIDC login chained into account takeover: email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the emailverified claim was only enforced when present as a boolean false so an absent or non-boolean claim was treated as verified.
Impact
An attacker who could authenticate at the configured OIDC provider with an email matching a victim's Coder account could log in as that victim and gain full access to their workspaces, templates and resources. This required OIDC authentication, attacker control of a matching email at the IdP and a victim account not yet linked to a different IdP subject.
Patches
The fix restricts the email fallback to first-time and legacy linking and defaults emailverified to false when the claim is absent or of an unexpected type.
The fix was backported to all supported release lines:
| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |
Workarounds
Configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.
Resources
- Fix: #25712, #25713
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22450) for independently disclosing this issue!
Other sources
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the emailverified claim was only enforced when present as a boolean false so an absent or non-boolean claim was treated as verified. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 restricts the email fallback to first-time and legacy linking and defaults emailverified to false when the claim is absent or of an unexpected type. As a workaround, configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.34.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.29.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.32.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.33.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.34.2 - Compensating control
As a workaround, configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55075?
The severity of CVE-2026-55075 is rated as high with a score of 7.4.
How do I fix CVE-2026-55075?
To fix CVE-2026-55075, ensure appropriate checks are in place for email-based user matching and validate the 'email_verified' claim properly.
What does CVE-2026-55075 affect?
CVE-2026-55075 affects the Coder Go software version located at go/github.com/coder/coder/v2.
What type of vulnerability is CVE-2026-55075?
CVE-2026-55075 is a vulnerability that can lead to an OIDC account takeover via flaws in user matching and claim verification.
Is CVE-2026-55075 easy to exploit?
Yes, CVE-2026-55075 has a risk score of 56, indicating that it can be exploited easily due to its reliance on email-based user matching without sufficient verification.