7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55076

CVE-2026-55076: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked email_verified with a direct Go bool type assertion. When an IdP returned the claim as a non-boolean (for example the string "false") or omitted it, the assertion failed open and the email was treated as verified. Combined with an unconditional email-based account fallback, this enabled account takeover. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 coerces email_verified across bool, string and numeric types (fail-closed) and blocks the email fallback when the matched user already has a different linked IdP subject. As a workaround, ensure the IdP returns email_verified as a native JSON boolean. The email-fallback linking issue has no configuration workaround; upgrading is required.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55076

CVE-2026-55076:

7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/coder/coder/v2	go	>= 2.34.0, < 2.34.2	2.34.2
github.com/coder/coder/v2	go	>= 2.33.0, < 2.33.8	2.33.8
github.com/coder/coder/v2	go	>= 2.30.0, < 2.32.7	2.32.7
github.com/coder/coder/v2	go	< 2.29.17	2.29.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability consists of two main issues that, when combined, lead to account takeover. The first is a type coercion bypass in the handling of the email_verified OIDC claim within the userOIDC function in coderd/userauth.go. The code was expecting a boolean value but failed to handle cases where an Identity Provider (IdP) would send a string (e.g., 'false') or other non-boolean types. This resulted in the email being treated as verified, even when it wasn't.

The second issue was an unconditional email-based account fallback in the findLinkedUser function, also in coderd/userauth.go. This function is called by both userOIDC and userOAuth2Github. If a user was not found by their unique linked ID, the system would fall back to searching for the user by their email address. An attacker could exploit this by registering an account with a vulnerable IdP using a victim's email address. Then, by logging into Coder via OIDC, the attacker's session would be linked to the victim's Coder account due to the email fallback, resulting in a full account takeover.

The patches address these issues by:

Introducing a coerceEmailVerified function to properly handle various data types for the email_verified claim, ensuring that the check is fail-closed.
Modifying findLinkedUser to restrict the email fallback mechanism. The fallback is now only allowed for first-time account linking, preventing an attacker from taking over an existing account that is already linked to a different IdP subject.

Vulnerable functions

API.userOIDC

coderd/userauth.go

The `userOIDC` function performed a direct type assertion on the `email_verified` claim. If the claim was not a boolean (e.g., a string like "false"), the assertion would fail, and the email would be treated as verified, bypassing the security check. This allowed an attacker to use an unverified email for account takeover.

findLinkedUser

coderd/userauth.go

The `findLinkedUser` function had an unconditional email-based account fallback. When a user was not found by their linked ID, it would fall back to searching by email. This allowed an attacker who registered a victim's email at a compatible IdP to be matched to the victim's existing Coder account, leading to account takeover.

API.userOAuth2Github

coderd/userauth.go

The `userOAuth2Github` function used the vulnerable `findLinkedUser` function, making it susceptible to the same account takeover vulnerability through email-based account fallback.

coerceEmailVerified

coderd/userauth.go

This function was introduced as part of the fix to correctly handle the `email_verified` claim from OIDC providers. It coerces boolean, string, and numeric types to a boolean value, closing the type coercion vulnerability. It is not a vulnerable function itself, but a mitigation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.