Authentication Bypass in Coder via OIDC Flaws

Executive Summary

This vulnerability affects Coder, a platform that allows organizations to provision remote development environments via Terraform. Prior to certain fixed versions, there were two flaws in Coder's OIDC login process that could lead to account takeover.

First, the system would fall back to linking user accounts by email without verifying if the email was already linked to a different identity provider (IdP) subject. Second, the `email_verified` claim was only enforced when it was explicitly present as a boolean false; if the claim was absent or not a boolean, it was treated as verified.

These issues allowed attackers to bypass proper verification and potentially take over accounts. The fix involved restricting the email fallback linking to first-time and legacy linking only, and defaulting the `email_verified` claim to false when it is missing or of an unexpected type.

As a workaround, it is recommended to configure the OIDC provider to disallow self-registration or require email verification before issuing tokens.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows account takeover through flaws in the OIDC login process, potentially leading to unauthorized access to user accounts and sensitive data.

Such unauthorized access could impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls on user authentication and protection of personal and sensitive information.

Specifically, failure to properly verify email claims and improper linking of user identities could result in data breaches or unauthorized data access, which are violations under these regulations.

Mitigations such as configuring the OIDC provider to disallow self-registration or require email verification before issuing tokens can help reduce compliance risks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to account takeover, meaning an attacker could gain unauthorized access to user accounts within the Coder platform.

Such unauthorized access could compromise sensitive development environments and code, potentially leading to data breaches, unauthorized code changes, or exposure of proprietary information.

Because the vulnerability allows bypassing of email verification and identity provider checks, it increases the risk of impersonation and unauthorized actions within the affected systems.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Coder to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2 where the issue is fixed.

As a workaround, configure your OIDC provider to disallow self-registration or require email verification before issuing tokens.

Useful 0 Not Useful 0