CVE-2026-55076: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
Summary
Coder's OIDC callback checked emailverified with a direct Go bool type assertion. When an IdP returned the claim as a non-boolean (for example the string "false") or omitted it, the assertion failed open and the email was treated as verified. Combined with an unconditional email-based account fallback, this enabled account takeover.
Impact
An attacker who registered a victim's email at a compatible IdP without verifying it could log in via OIDC and be matched to the victim's existing Coder account, receiving a session for that account. No prior authentication to Coder was required and the result was full account takeover.
Patches
The fix coerces emailverified across bool, string and numeric types (fail-closed) and blocks the email fallback when the matched user already has a different linked IdP subject.
The fix was backported to all supported release lines:
| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |
Workarounds
Ensure the IdP returns emailverified as a native JSON boolean. The email-fallback linking issue has no configuration workaround; upgrading is required.
Resources
- Fix: #25712, #25713
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22444) for independently disclosing this issue!
Other sources
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked emailverified with a direct Go bool type assertion. When an IdP returned the claim as a non-boolean (for example the string "false") or omitted it, the assertion failed open and the email was treated as verified. Combined with an unconditional email-based account fallback, this enabled account takeover. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 coerces emailverified across bool, string and numeric types (fail-closed) and blocks the email fallback when the matched user already has a different linked IdP subject. As a workaround, ensure the IdP returns emailverified as a native JSON boolean. The email-fallback linking issue has no configuration workaround; upgrading is required.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.34.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.29.17 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.32.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.33.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.34.2 - Configuration
Update the IdP’s OIDC claim for `email_verified` to return it as a native JSON boolean (e.g., `true`/`false`), not as a string (e.g., "false") or omitted.
OIDC Identity Provider (IdP) email_verified = native JSON boolean
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55076?
CVE-2026-55076 has a high severity rating of 7.4.
What does CVE-2026-55076 enable an attacker to do?
CVE-2026-55076 enables an attacker to perform account takeover via unverified email linking.
How do I fix CVE-2026-55076?
To fix CVE-2026-55076, ensure that the `email_verified` claim is properly validated as a boolean type.
Which software is affected by CVE-2026-55076?
CVE-2026-55076 affects the Coder application and its Go module at github.com/coder/coder/v2.
What results from the type coercion issue in CVE-2026-55076?
The type coercion issue in CVE-2026-55076 results in unverified emails being incorrectly treated as verified.