Coder · Coder · CVE-2026-55075
**Name of the Vulnerable Software and Affected Versions**
Coder versions prior to 2.34.2
Coder versions prior to 2.33.8
Coder versions prior to 2.32.7
Coder versions prior to 2.29.17
**Description**
Two flaws in the OIDC login process allow for account takeover. The first issue occurs when email-based user matching falls back to linking by email without verifying if an existing link to a different Identity Provider (IdP) subject already exists. The second issue involves the `email verified` claim, which is only enforced when explicitly set to the boolean `false`; if the claim is absent or not a boolean, it is treated as verified. An attacker who can authenticate with a configured OIDC provider using an email that matches a victim's account can gain full access to that victim's workspaces, templates, and resources, provided the account is not yet linked to another IdP subject.
**Recommendations**
Update to version 2.34.2 or newer.
Update to version 2.33.8 or newer.
Update to version 2.32.7 or newer.
Update to version 2.29.17 or newer.
Configure the OIDC provider to disallow self-registration or require email verification before issuing tokens.