CVE-2026-55076

Executive Summary

CVE-2026-55076 is a critical authentication bypass vulnerability in Coder, a platform for provisioning remote development environments via Terraform. The flaw resides in the OIDC callback handler, where the email_verified claim is improperly validated using a direct Go bool type assertion. When an Identity Provider (IdP) returns the claim as a non-boolean value (e.g., the string "false") or omits it entirely, the assertion fails open, treating the email as verified. Combined with an unconditional email-based account fallback mechanism, this allows an attacker to take over any account by simply knowing the victim's email address.

The vulnerability has a CVSS score of 7.4 (High) and affects all Coder versions prior to the patched releases. No public proof-of-concept (PoC) or exploit code is currently available, but the attack vector is straightforward and requires no authentication. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant due to the ease of exploitation.

Supply Chain & Package Security

Coder is a Go-based application. The vulnerability is in the core OIDC authentication logic, not in a third-party package. However, organizations using Coder should verify their deployment's integrity and ensure no compromised images or binaries are in use. The fix is available in the official Coder releases.

CVSS Breakdown & Threat Level

• CVSS Score: 7.4 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: None

The vulnerability allows an unauthenticated attacker to take over any user account, leading to full compromise of the victim's development environments, source code, and credentials.

Deep Dive & Mechanics

The vulnerability is rooted in Coder's OIDC callback handler, which processes the email_verified claim from the IdP. In Go, a type assertion like emailVerified := claims["email_verified"].(bool) will panic if the value is not a bool. However, Coder's code used a two-value assertion form: emailVerified, ok := claims["email_verified"].(bool). When the claim is missing or is a non-boolean type (e.g., string "false"), ok is false, and emailVerified is set to the zero value for bool, which is false. The critical bug is that the code then checks if !emailVerified to reject unverified emails. But if the assertion fails, emailVerified is false, and the condition !emailVerified evaluates to true, causing the code to treat the email as verified (fail-open).

The second part of the vulnerability is the email-based account fallback. When a user logs in via OIDC, Coder attempts to match the user by the email claim. If a match is found, it links the OIDC identity to the existing account. This fallback is unconditional, meaning an attacker who can forge or control the email claim (or simply use an IdP that returns a controlled email) can take over any account.

The fix in patched versions:

1. Coerces email_verified across bool, string, and numeric types using a helper function that fails closed (returns false for invalid types).
2. Blocks the email fallback when the matched user already has a different linked IdP subject, preventing account takeover via email collision.

Vulnerable vs. Patched Code

Vulnerable Code (Go):

// Vulnerable: type assertion fails open
emailVerified, ok := claims["email_verified"].(bool)
if !ok {
    // Fail-open: treats missing/non-bool as verified
    emailVerified = true
}
if !emailVerified {
    // Reject unverified emails
    return nil, xerrors.New("email not verified")
}

Patched Code (Go):

// Patched: coercion function fails closed
func getEmailVerified(claims map[string]interface{}) bool {
    switch v := claims["email_verified"].(type) {
    case bool:
        return v
    case string:
        // Only "true" (case-insensitive) is considered verified
        return strings.EqualFold(v, "true")
    case float64:
        // Non-zero numeric values are considered verified
        return v != 0
    default:
        // Fail-closed: any other type or missing claim is unverified
        return false
    }
}

emailVerified := getEmailVerified(claims)
if !emailVerified {
    return nil, xerrors.New("email not verified")
}

Additionally, the patched code adds a check to prevent email fallback when the user already has a different IdP subject:

if existingUser.OIDCSubject != "" && existingUser.OIDCSubject != oidcSubject {
    return nil, xerrors.New("user already linked to a different OIDC provider")
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to a Coder instance with OIDC enabled.
• Ability to register or use an IdP that returns a non-boolean email_verified claim (e.g., a custom IdP or one that omits the claim).
• Knowledge of a victim's email address.

Exploitation Steps:

1. Set up a malicious IdP (e.g., using a simple OIDC provider like Dex or Keycloak) that returns the email_verified claim as a string "false" or omits it entirely.
2. Configure the IdP to return the victim's email address in the email claim.
3. Initiate an OIDC login flow to the vulnerable Coder instance.
4. The vulnerable code treats the email as verified due to the fail-open assertion.
5. The email-based account fallback links the attacker's OIDC identity to the victim's account.
6. The attacker now has full access to the victim's development environments.

Lab Setup:

# Start a vulnerable Coder instance (e.g., version 2.29.6)
docker run -d --name coder-vuln -p 8080:8080 coder/coder:2.29.6

# Configure OIDC with a custom IdP (e.g., using a simple Python script)
# The IdP should return:
# {
#   "email": "victim@example.com",
#   "email_verified": "false"  # string, not boolean
# }

Blue Team (Defender)

Detection Steps:

1. Monitor OIDC callback logs for unusual email_verified claim types (non-boolean).
2. Alert on account linking events where the OIDC subject changes for an existing user.
3. Review IdP configuration to ensure email_verified is returned as a native JSON boolean.
4. Implement additional validation in reverse proxy or WAF to block non-boolean email_verified claims.

Hunting Query (Splunk):

index=coder sourcetype=coder:audit
| search "OIDC callback" "email_verified"
| eval claim_type=if(match(raw, "\"email_verified\":\"[^\"]+\""), "string", "boolean")
| where claim_type="string"
| table _time, user, email, claim_type

Indicators of Compromise (IOCs)

• Log Entries: OIDC callback logs showing email_verified as a string or missing.
• Account Linking: Audit logs showing a user's OIDC subject changing unexpectedly.
• Network Traffic: OIDC authorization requests with manipulated email_verified claim.
• File Hashes: No specific file hashes; focus on Coder binary versions.
• C2 Patterns: No known C2; the attack is direct account takeover.

Detection Engineering

YARA Rule

rule CVE_2026_55076_OIDC_EmailVerified {
    meta:
        description = "Detects vulnerable Coder OIDC callback code with fail-open email_verified assertion"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-55076"
        hash = "sha256:EXAMPLE"
    strings:
        $s1 = "email_verified" ascii wide nocase
        $s2 = ".bool" ascii wide
        $s3 = "emailVerified, ok" ascii wide
        $s4 = "if !ok" ascii wide
        $s5 = "emailVerified = true" ascii wide
    condition:
        all of ($s1, $s2, $s3, $s4, $s5)
}

Sigma Rule

title: Coder OIDC Email Verified Fail-Open Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects OIDC callback requests with non-boolean email_verified claim
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55076
logsource:
    category: application
    product: coder
    service: oidc
detection:
    selection:
        claim.email_verified|re: '^[^true|false]'  # Not a boolean
    condition: selection
falsepositives:
    - Legitimate IdP misconfiguration
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-55076 Coder OIDC Email Verified Fail-Open";
    flow:to_server,established;
    content:"email_verified"; http_client_body;
    pcre:"/\"email_verified\"\s*:\s*\"[^\"]+\"/i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coder to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2 immediately.
2. If upgrade is not possible, ensure the IdP returns email_verified as a native JSON boolean (true or false).
3. Disable email-based account fallback if not required (check Coder configuration).

Long-term Measures:

1. Implement strict input validation for all OIDC claims.
2. Use a Web Application Firewall (WAF) to inspect OIDC callback payloads.
3. Enable multi-factor authentication (MFA) for all accounts.
4. Regularly audit user account linking events.

Workaround:

• Ensure the IdP returns email_verified as a native JSON boolean. This prevents the fail-open but does not fix the email fallback issue. Upgrading is required for full remediation.

Valters IT
Securing your code, one CVE at a time.