Authentication Bypass in Coder via OIDC Flaws

Executive Summary

This vulnerability affects Coder, a platform that allows organizations to provision remote development environments via Terraform. Prior to certain fixed versions, there were two flaws in Coder's OIDC login process that could lead to account takeover.

First, the system would fall back to linking user accounts by email without verifying if the email was already linked to a different identity provider (IdP) subject. Second, the `email_verified` claim was only enforced when it was explicitly present as a boolean false; if the claim was absent or not a boolean, it was treated as verified.

These issues allowed attackers to bypass proper verification and potentially take over accounts. The fix involved restricting the email fallback linking to first-time and legacy linking only, and defaulting the `email_verified` claim to false when it is missing or of an unexpected type.

As a workaround, it is recommended to configure the OIDC provider to disallow self-registration or require email verification before issuing tokens.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows account takeover through flaws in the OIDC login process, potentially leading to unauthorized access to user accounts and sensitive data.

Such unauthorized access could impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls on user authentication and protection of personal and sensitive information.

Specifically, failure to properly verify email claims and improper linking of user identities could result in data breaches or unauthorized data access, which are violations under these regulations.

Mitigations such as configuring the OIDC provider to disallow self-registration or require email verification before issuing tokens can help reduce compliance risks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to account takeover, meaning an attacker could gain unauthorized access to user accounts within the Coder platform.

Such unauthorized access could compromise sensitive development environments and code, potentially leading to data breaches, unauthorized code changes, or exposure of proprietary information.

Because the vulnerability allows bypassing of email verification and identity provider checks, it increases the risk of impersonation and unauthorized actions within the affected systems.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Coder to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2 where the issue is fixed.

As a workaround, configure your OIDC provider to disallow self-registration or require email verification before issuing tokens.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper handling of OIDC login flows in Coder, specifically related to email-based user matching and the email_verified claim. Detection would focus on monitoring authentication logs for unusual login attempts where the email fallback mechanism is triggered or where the email_verified claim is missing or malformed.

Since the vulnerability is related to OIDC authentication, you can detect suspicious activity by examining logs for failed or unusual OIDC login attempts, especially those that result in account takeover or unexpected access.

Suggested commands depend on your environment and logging setup, but generally you can search logs for OIDC login events and anomalies. For example, if logs are stored in files, you might use commands like:

• grep 'OIDC login' /var/log/coder/auth.log | grep -i 'email_verified'
• grep -E 'login failed|403' /var/log/coder/auth.log
• journalctl -u coder.service | grep -i 'linked_id'

Additionally, monitoring for unexpected 403 errors during login attempts may indicate the new stricter checks blocking mismatched linked_id values.

For network detection, monitoring OIDC token issuance and verifying that tokens include a valid and boolean email_verified claim can help detect attempts to exploit this vulnerability.

Ultimately, upgrading to the fixed versions is strongly recommended to prevent exploitation rather than relying solely on detection.

Useful 0 Not Useful 0