CVE-2026-55076 coder CVE debrief

Who should care

Organizations using Coder versions prior to 2.29.7, 2.32.7, 2.33.8, or 2.34.2 should be concerned about this vulnerability. Specifically, users who rely on OIDC callbacks for authentication and have not upgraded to the patched versions are at risk. Additionally, security teams responsible for monitoring and mitigating potential account takeover attacks should be aware of this issue.

Technical summary

The vulnerability in Coder's OIDC callback arises from the improper handling of the `email_verified` claim. Normally, this claim is expected to be a boolean value indicating whether the user's email has been verified by the Identity Provider (IdP). However, if the IdP returns this claim as a non-boolean value (such as a string) or omits it altogether, Coder's previous implementation would fail open. This means that even if the email was not verified, Coder would treat it as verified. This issue is exacerbated by Coder's unconditional email-based account fallback mechanism. An attacker could exploit this by manipulating the `email_verified` claim to gain unauthorized access to a user's account.

Defensive priority

High

Recommended defensive actions

• Upgrade to Coder version 2.29.7, 2.32.7, 2.33.8, or 2.34.2, or later.
• Ensure that the Identity Provider (IdP) returns `email_verified` as a native JSON boolean.
• Monitor for and respond to potential account takeover attempts.
• Review and update authentication and authorization configurations.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record was published on 2026-07-07T23:16:55.237Z and has not been modified since then. The NVD entry is currently 7.4 HIGH. The vulnerability in Coder's OIDC callback arises from the improper handling of the `email_verified` claim. Normally, this claim is expected to be a boolean value indicating whether the user's email has been verified by the Identity Provider (IdP). However, if the IdP returns this claim as a non-boolean value (such as a string) or omits it altogether, Coder's previous implementation would fail open. This means that even if the email was not verified, Coder would treat it as verified. The email-fallback linking issue has no configuration workaround; upgrading is required. As a workaround, ensure the IdP returns `email_verified` as a native JSON boolean.

Official resources