CVE-2026-55075: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in…

PriorityP347high7.4CVSS 3.1

AVNACHPRNUINSUCHIHAN

EPSS

0.48%

40.5th percentile

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean `false` so an absent or non-boolean claim was treated as verified. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 restricts the email fallback to first-time and legacy linking and defaults `email_verified` to false when the claim is absent or of an unexpected type. As a workaround, configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
coder	coder	< 2.29.17	2.29.17
coder	coder	—	—
coder	coder	—	—
coder	coder	—	—
coder	coder	>= 2.30.0 < 2.32.7	2.32.7
coder	coder	>= 2.33.0 < 2.33.8	2.33.8
coder	coder	>= 2.34.0 < 2.34.2	2.34.2
github.com	coder_coder_v2	>= 0 < 2.29.17	2.29.17
github.com	coder_coder_v2	>= 2.30.0 < 2.32.7	2.32.7
github.com	coder_coder_v2	>= 2.33.0 < 2.33.8	2.33.8
github.com	coder_coder_v2	>= 2.34.0 < 2.34.2	2.34.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.