Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

Description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean `false` so an absent or non-boolean claim was treated as verified. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 restricts the email fallback to first-time and legacy linking and defaults `email_verified` to false when the claim is absent or of an unexpected type. As a workaround, configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.

Scores

EPSS (exploitation in 30 days)

0.48% · top 58% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.

Weakness

• CWE-287: Improper Authentication (opens in a new tab)All about CWE-287 and its CVEs
• CWE-289: Authentication Bypass by Alternate Name (opens in a new tab)All about CWE-289 and its CVEs

Affected products

• coder · coder

  • affected >= 2.34.0, < 2.34.2
  • affected >= 2.33.0, < 2.33.8
  • affected >= 2.30.0, < 2.32.7
  • affected < 2.29.17

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Gogithub.com/coder/coder/v2GHSA-9r87-mvcw-x35f (opens in a new tab)

References (7)

• https://github.com/coder/coder/security/advisories/GHSA-9r87-mvcw-x35f (opens in a new tab)x_refsource_CONFIRM
• https://github.com/coder/coder/pull/25712 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/pull/25713 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.29.17 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.32.7 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.33.8 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.34.2 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-9r87-mvcw-x35f (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-55075](https://trackcve.app/badge/CVE-2026-55075.svg)](https://trackcve.app/cve/CVE-2026-55075)

Record last updated 8 Jul 2026, 13:03 UTC.