Authentication Bypass via Unsuspended API Keys in Coder

Executive Summary

This vulnerability exists in the Coder platform's AI Bridge proxy endpoints, which authenticate requests using API keys. The authentication process checks key format, expiry, secret, and whether the user is deleted or a system user, but it does not verify if the user account is suspended.

As a result, suspended users with unexpired API keys can continue to access the AI Bridge endpoints, even though their accounts are suspended. This means that suspension does not immediately revoke access if the API keys remain valid.

The issue affects versions starting from 2.30.0 up to versions prior to 2.32.7, 2.33.8, and 2.34.2, which include patches to fix this problem by rejecting non-active users during authorization.

A workaround is to manually delete the suspended user's API keys to prevent continued access.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows suspended users to retain access to AI Bridge LLM proxy endpoints using their unexpired API keys. This can lead to unauthorized use of paid provider resources and invocation of MCP tools if enabled.

Because the API keys remain valid until they expire or are deleted, suspended users may continue to consume resources and potentially perform actions they should no longer be authorized to do.

The practical impact is limited to already-issued API keys of suspended users until those keys are deleted or expire.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves suspended users retaining access via unexpired API keys because the system does not check if the user account is suspended during authorization. Detection involves identifying API keys belonging to suspended users that are still active.

A practical detection approach is to audit API keys issued to users and verify if any keys are active for users whose accounts are suspended. Since the vulnerability is related to API key usage, monitoring API calls to AI Bridge proxy endpoints and correlating them with user account status can help detect exploitation.

Commands to assist detection might include querying the user database or API key management system to list API keys for suspended users. For example, using the Coder API or CLI to list users and their keys, then filtering for suspended accounts with active keys.

• Use the DELETE /api/v2/users/{user}/keys endpoint to manage keys, which implies you can GET or list keys similarly to detect active keys for suspended users.
• Monitor logs for AI Bridge proxy endpoint access and correlate with user status to identify unauthorized access by suspended users.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to delete API keys of suspended users, as suspension alone does not revoke existing API keys.

This can be done by issuing a DELETE request to the API endpoint: DELETE /api/v2/users/{user}/keys for each suspended user.

Additionally, upgrading Coder to versions 2.32.7, 2.33.8, or 2.34.2 is strongly recommended, as these versions include patches that enforce active user checks during authorization, preventing suspended users from accessing AI Bridge proxy endpoints.

• Manually delete API keys of suspended users using the DELETE /api/v2/users/{user}/keys API.
• Upgrade Coder to version 2.32.7 or later (e.g., 2.33.8, 2.34.2) to apply the official patch that enforces user active status checks.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows suspended users to retain access to AI Bridge proxy endpoints via unexpired API keys because the system does not check if an account is suspended during authorization. This could lead to unauthorized access to resources and potential misuse of paid provider resources.

While the CVE description and resources do not explicitly mention compliance with standards such as GDPR or HIPAA, the issue of suspended users retaining access could pose risks related to unauthorized access and data protection requirements common in these regulations.

Organizations relying on Coder versions affected by this vulnerability should consider the risk that suspended accounts might still access sensitive development environments or data, which could impact compliance with access control and user management policies required by standards like GDPR and HIPAA.

The vulnerability is mitigated in patched versions (2.32.7, 2.33.8, and 2.34.2) which enforce active user checks during authorization, and a workaround exists to delete API keys upon suspension to prevent continued access.

Useful 0 Not Useful 0