Coder's OIDC callback implementation performed a direct Go bool type assertion on the email_verified claim. When the IdP returned this claim as a non-boolean (e.g., the string "false") or omitted it, the assertion failed open, causing the system to treat the email as verified erroneously. Because Coder used an unconditional email-based account fallback, an attacker could register a victim's email at a compatible IdP without verifying it, then log in via OIDC and be matched to the victim's existing Coder account, resulting in full account takeover without prior authentication. The fix coerces email_verified across bool, string, and numeric types in a fail-closed manner and blocks email fallback when the matched user already has a different linked IdP subject. The fix has been backported to all supported release lines, specifically versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17.

An attacker can take over any existing Coder account by registering the victim's email at a compatible IdP without verifying it, then authenticating via OIDC. This results in full account compromise without requiring prior authentication to Coder. The vulnerability affects confidentiality and integrity of user accounts but does not impact availability.

A fix is available and has been backported to all supported release lines: 2.34.2, 2.33.8, 2.32.7, and 2.29.17. Users should upgrade to these patched versions to remediate the vulnerability. As a partial workaround, ensure the IdP returns the email_verified claim as a native JSON boolean; however, this does not fully mitigate the email fallback linking issue, which requires upgrading.