Two vulnerabilities in Coder's OIDC login flow enable account takeover by chaining email-based user matching fallback without verifying existing IdP links and incorrect handling of the email_verified claim. The email fallback linked accounts by email without checking if the email was already linked to a different IdP subject. Additionally, the email_verified claim was only enforced when explicitly false as a boolean, so absent or non-boolean claims were treated as verified. This allowed an attacker who could authenticate at the configured OIDC provider with a matching email to log in as the victim and access their resources. The fix restricts email fallback to first-time and legacy linking and defaults email_verified to false if the claim is missing or malformed. The fix was backported to all supported release lines including versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2.

An attacker with control over an OIDC provider account using an email matching a victim's Coder account could bypass authentication checks and gain full access to the victim's workspaces, templates, and resources. This compromises confidentiality and integrity of user data but does not affect availability. The attack requires the victim's account to be unlinked from other IdP subjects and the attacker to authenticate successfully at the OIDC provider.

Official patches are available and have been backported to all supported release lines: 2.29.17, 2.32.7, 2.33.8, and 2.34.2. Users should upgrade to these versions or later to remediate the vulnerability. As a workaround, configuring the OIDC provider to disallow self-registration or require email verification before issuing tokens can reduce risk. No other mitigations are indicated by the vendor advisory.