Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when… (CVE-2025-71435)

The vulnerability in Coder prior to version 2.23.0 allows authenticated users to bypass session expiration controls. Specifically, when no refresh token is issued, users can maintain their session by keeping the APIKey cookie active through regular usage, which extends the cookie's validity every 24 hours. This flaw enables users to continue accessing Coder indefinitely after their OIDC token has expired, effectively bypassing intended session expiration mechanisms.

The vulnerability allows authenticated users to maintain access to Coder beyond the intended session expiration period after OIDC token expiry. This could lead to prolonged unauthorized access if a user's OIDC authorization is revoked or expires, potentially increasing the risk of unauthorized actions within the system. The impact is rated as low given the requirement for prior authentication and the complexity of exploitation.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should monitor for updates from the vendor and consider additional session management controls or token revocation mechanisms where possible.