CVE-2026-55075: coder Improper Authentication

Vulnerability summary

CVE-2026-55075 is a high (CVSS 7.4) Improper Authentication vulnerability in coder. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 39.9% of scored vulnerabilities.

Timeline

1. 07-07-2026
   PublishedVulnerability first disclosed.
2. 08-07-2026
   Last modifiedVulnerability information updated.

Description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean `false` so an absent or non-boolean claim was treated as verified. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 restricts the email fallback to first-time and legacy linking and defaults `email_verified` to false when the claim is absent or of an unexpected type. As a workaround, configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-289Authentication Bypass by Alternate NameThe product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.