7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55075

CVE-2026-55075: Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the email_verified claim was only enforced when present as a boolean false so an absent or non-boolean claim was treated as verified. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 restricts the email fallback to first-time and legacy linking and defaults email_verified to false when the claim is absent or of an unexpected type. As a workaround, configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55075

CVE-2026-55075:

7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/coder/coder/v2	go	>= 2.34.0, < 2.34.2	2.34.2
github.com/coder/coder/v2	go	>= 2.33.0, < 2.33.8	2.33.8
github.com/coder/coder/v2	go	>= 2.30.0, < 2.32.7	2.32.7
github.com/coder/coder/v2	go	< 2.29.17	2.29.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis identified two key functions in coderd/userauth.go that were responsible for the OIDC account takeover vulnerability.

The first vulnerable function, findLinkedUser, allowed an attacker to link their OIDC account to a victim's Coder account by exploiting the email-based user matching fallback. The function would first attempt to find a user by their linked_id, but if that failed, it would fall back to searching by email. An attacker could abuse this by creating an OIDC account with the same email as the victim. The patch mitigates this by restricting the email fallback to only first-time account linking and legacy accounts, preventing an existing account from being linked to a new OIDC subject.

The second vulnerable function, API.userOIDC, improperly validated the email_verified claim. The original implementation only checked for a boolean false value, treating any other value or an absent claim as verified. This allowed an attacker to bypass email verification. The patch introduces a new function, coerceEmailVerified, which correctly handles various data types for the email_verified claim and defaults to false (unverified) if the claim is missing or in an unexpected format.

By analyzing the provided patches, it was possible to pinpoint these two functions as the root cause of the vulnerability. The identified functions would be present in runtime profiles during an exploitation attempt, making them critical indicators for detecting and responding to this vulnerability.

Vulnerable functions

findLinkedUser

coderd/userauth.go

The `findLinkedUser` function was vulnerable because it would fall back to email-based user matching if a user was not found by their `linked_id`. An attacker could exploit this by creating an account on the OIDC provider with the victim's email address. When the attacker logs in, `findLinkedUser` would fail to find a user by `linked_id` (since the attacker has a different OIDC subject) and would then fall back to finding the user by email, thus linking the attacker's OIDC account to the victim's Coder account.

API.userOIDC

coderd/userauth.go

The `userOIDC` function was vulnerable because it did not correctly validate the `email_verified` claim from the OIDC provider. It only checked if the claim was a boolean `false`. If the claim was absent, a string, or any other non-boolean type, the check would pass, and the email would be considered verified. This allowed an attacker to bypass email verification by using an OIDC provider that sends a non-boolean `email_verified` claim or no claim at all.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.