Authentication Bypass in Coder via OIDC email_verified Handling

Executive Summary

This vulnerability exists in Coder's OIDC callback prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2. The issue arises because the system checked the `email_verified` claim using a direct Go boolean type assertion. If the Identity Provider (IdP) returned the claim as a non-boolean value (such as the string "false") or omitted it, the assertion failed open, causing the email to be treated as verified even when it was not.

Combined with an unconditional email-based account fallback, this flaw allowed attackers to take over accounts. The fix involves coercing the `email_verified` claim across boolean, string, and numeric types in a fail-closed manner and blocking the email fallback if the matched user already has a different linked IdP subject.

As a temporary workaround, the IdP must return `email_verified` as a native JSON boolean, but the email-fallback linking issue requires upgrading to a fixed version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to account takeover because the system may incorrectly treat an unverified email as verified. Attackers can exploit this by bypassing proper verification checks and gaining unauthorized access to user accounts.

Such unauthorized access can compromise confidentiality and integrity of user data and resources within the Coder environment.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Coder to one of the fixed versions: 2.29.7, 2.32.7, 2.33.8, or 2.34.2.

As a workaround before upgrading, ensure that your Identity Provider (IdP) returns the 'email_verified' claim as a native JSON boolean value.

Note that the email-fallback linking issue has no configuration workaround, so upgrading is required to fully address the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to bypass email verification and potentially take over user accounts due to improper handling of the email_verified claim in OIDC callbacks. Such unauthorized account takeover risks compromising sensitive user data.

Because the vulnerability can lead to unauthorized access to user accounts and sensitive information, it may negatively impact compliance with data protection standards and regulations such as GDPR and HIPAA, which require strict access controls and protection of personal data.

Mitigating this vulnerability by upgrading to fixed versions or ensuring proper IdP configuration is essential to maintain compliance with these standards.

Useful 0 Not Useful 0