CVE-2025-71435
Received Received - Intake

Session Expiration Bypass in Coder Before 2.23.0

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2025-71435
EUVD
EUVD-2025-211113

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
coder coder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2025-71435 is a session expiration bypass in Coder versions before 2.23.0. When users authenticate via OIDC without a refresh token, the system fails to enforce token expiry. Users can retain access indefinitely by regularly using their APIKey cookie, which extends the session every 24 hours even after OIDC authorization lapses.

Detection Guidance

To detect this vulnerability, check Coder versions before 2.23.0 using commands like 'coder version' or inspect deployment manifests. Monitor APIKey cookie activity and OIDC token expiry mismatches in logs. Look for sessions extending beyond OIDC token validity without refresh tokens.

Impact Analysis

This vulnerability allows authenticated users to maintain access to Coder even after their OIDC token expires. By using the APIKey cookie regularly, they can extend their session indefinitely, bypassing intended session expiration. This could lead to unauthorized prolonged access to the system.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized continued access to systems even after OIDC token expiration. If an authenticated user's session is improperly maintained beyond authorization, it may violate principles of least privilege and data protection requirements under these regulations.

Mitigation Strategies

Upgrade Coder to version 2.23.0 or later immediately. Review and revoke all existing APIKeys, especially those issued before the upgrade. Monitor user sessions for unusual activity and enforce strict OIDC token refresh policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart