Coder OIDC Account Takeover via email_verified Bypass CVE-2025-56075 Advisory

Vulnerability Overview Title: OIDC Account Takeover via Email-Based User Matching and email_verified Bypass Description: Summary: Two vulnerabilities in Coder's OIDC login allow for account takeover. The first vulnerability is that email-based user matching does not check for existing links to different IDP subjects. The second vulnerability is that the claim is only enforced when it is explicitly the boolean value , while missing claims or non-boolean values are treated as verified. Impact: Attackers can gain full access to a victim's workspaces, templates, and resources by configuring an OIDC provider to log in with an email address that matches the victim's Coder account. This requires OIDC authentication, where the attacker controls the matching email on the IDP, and the victim's account is not already linked to a different IDP subject. Affected Versions Affected Versions: - - - - Fixed Versions: - - - - Remediation Patch: - The fix restricts email fallback to the initial and legacy linked accounts, and defaults to when the claim is missing or of an unexpected type. - The fix has been backported to all supported release lines. Workaround: - Configure the OIDC provider to disallow self-registration or require email verification before token issuance. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None CVE ID: CVE-2025-56075 Weaknesses: - CWE-287 - CWE-289 References: - Fix: #25712, #25713 Acknowledgments: - Thanks to the Anthropic Security Team (ANT-2026-22450) for independently disclosing this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Coder OIDC Account Takeover via email_verified Bypass CVE-2025-56075 Advisory

More from this source