Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

Coder allows unauthorized users to register with similar email domains

CVE-2024-27918 · published 2 years ago
Summary

If your Coder instance uses OIDC authentication and allows users to create accounts, an attacker could potentially register an account with an email address that's similar to an allowed domain. This could happen if your OIDC provider allows users to create accounts without a verified email address. To fix this, update your Coder instance to the latest version, especially if you're using OIDC authentication with custom email domains.

What to do
  • Update github.com coder to version 2.8.4.
  • Update github.com coder to version 2.7.3.
  • Update github.com coder to version 2.6.1.
Affected software
Ecosystem VendorProductAffected versions
go github.com coder >= 2.8.0, < 2.8.4
>= 2.7.0, < 2.7.3
< 2.6.1
Fix: upgrade to 2.8.4
go github.com coder <= 0.27.3
– coder coder < 2.6.1
>= 2.7.0, < 2.7.3
>= 2.8.0, < 2.8.4
cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*
Original advisory text
Coder's OIDC authentication allows email with partially matching domain to register
Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the `CODER_OIDC_EMAIL_DOMAIN` verification and create an account with an email not in the allowlist. Deployments are only affected if the OIDC provider allows users to create accounts on the provider. During OIDC registration, the user's email was improperly validated against the allowed `CODER_OIDC_EMAIL_DOMAIN`s. This could allow a user with a domain that only partially matched an allowed domain to successfully login or register. An attacker could register a domain name that exploited this vulnerability and register on a Coder instance with a public OIDC provider.

Coder instances with OIDC enabled and protected by the `CODER_OIDC_EMAIL_DOMAIN` configuration are affected. Coder instances using a private OIDC provider are not affected, as arbitrary users cannot register through a private OIDC provider without first having an account on the provider. Public OIDC providers are impacted. GitHub authentication and external authentication are not impacted. This vulnerability is remedied in versions 2.8.4, 2.7.3, and 2.6.1 All versions prior to these patches are affected by the vulnerability.*It is recommended that customers upgrade their deployments as soon as possible if they are utilizing OIDC authentication with the `CODER_OIDC_EMAIL_DOMAIN` setting.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published6 Mar 2024
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-7cc2-r658-7xpf · GHSA
CVE-2024-27918 · NVD
CVE-2024-27918 · OSV
Track software like this
Free during beta