CyberRota Analysis
AI-GeneratedOrganizations using Coder for provisioning remote development environments via Terraform are vulnerable to account takeover due to flaws in the OIDC login process prior to specific patched versions. The vulnerabilities allow attackers to exploit improper email matching and verification claims, potentially leading to unauthorized access to user accounts. It is crucial for affected organizations to prioritize upgrading to the fixed versions or implementing workarounds to secure their OIDC configurations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean `false` so an absent or non-boolean claim was treated as verified. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 restricts the email fallback to first-time and legacy linking and defaults `email_verified` to false when the claim is absent or of an unexpected type. As a workaround, configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.
Related CVEs
Other vulnerabilities affecting the same vendor(s)