Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.4

Coder may let attackers take over accounts via email link

CVE-2026-55076 · published 4 months ago
Summary

Older versions of Coder could treat an unverified email as verified when the identity provider sent the verification flag in an unexpected format or omitted it. This mistake allowed someone to claim another user's account by linking an email address. Upgrade to the latest Coder release or make sure the identity provider returns a proper true/false value for email verification.

What to do
  • Update github.com coder to version 2.34.2.
  • Update github.com coder to version 2.33.8.
  • Update github.com coder to version 2.32.7.
  • Update github.com coder to version 2.29.17.
Affected software
Ecosystem VendorProductAffected versions
go github.com coder >= 2.34.0, < 2.34.2
>= 2.33.0, < 2.33.8
>= 2.30.0, < 2.32.7
< 2.29.17
Fix: upgrade to 2.34.2
– coder coder >= 2.34.0, < 2.34.2
< 2.29.17
>= 2.30.0, < 2.32.7
>= 2.33.0, < 2.33.8
Original advisory text
Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked `email_verified` with a direct Go `bool` type assertion. When an IdP returned the claim as a non-boolean (for example the string `"false"`) or omitted it, the assertion failed open and the email was treated as verified. Combined with an unconditional email-based account fallback, this enabled account takeover. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 coerces `email_verified` across bool, string and numeric types (fail-closed) and blocks the email fallback when the matched user already has a different linked IdP subject. As a workaround, ensure the IdP returns `email_verified` as a native JSON boolean. The email-fallback linking issue has no configuration workaround; upgrading is required.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
7.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
CWE-704Incorrect Type Conversion or Cast
Timeline
Published7 Jul 2026
Updated4 Nov 2026
First seen6 Jul 2026
Sources
GHSA-75vm-6w67-gwvp · GHSA
CVE-2026-55076 · NVD
CVE-2026-55076 · MITRE
CVE-2026-55076 · OSV
Track software like this
Free during beta