GHSA-75vm-6w67-gwvp: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
Summary
Coder's OIDC (OpenID Connect, a login standard) authentication had a bug where it didn't properly check if an email was verified when the identity provider returned the verification status as a string or omitted it entirely, causing it to assume the email was verified by default. An attacker could use this flaw to take over someone's account by registering their email at a compatible identity provider without verifying it, then logging in through OIDC to gain access to the victim's Coder account.
Solution / Mitigation
Upgrade to one of the patched versions: v2.34.2 (for release line 2.34), v2.33.8 (for 2.33), v2.32.7 (for 2.32), or v2.29.17 (for 2.29 ESR). The fix properly handles the `email_verified` claim across boolean, string, and numeric types and blocks email-based account matching when the user already has a different linked identity provider. As a temporary workaround, ensure your identity provider returns `email_verified` as a native JSON boolean, though upgrading is still required to fully address the email-fallback linking issue.
Vulnerability Details
EPSS: 0.0%
Yes
July 6, 2026
Classification
Affected Vendors
Affected Packages
Related Issues
Original source: https://github.com/advisories/GHSA-75vm-6w67-gwvp
First tracked: July 6, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 72%