Read the docs
TI-2025-43927 Aliases CVE-2025-71435GHSA-hpmf-3824-qwg6

Session expiration bypass in Coder with OIDC lets users keep access

Priority LOW 11CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

Coder before 2.23.0 contains a session expiration bypass that lets authenticated users keep access after their OIDC token expires when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours, and so retain access to Coder after losing OIDC authorization. The flaw is classified as insufficient session expiration (CWE-613). An attacker needs only a low-privileged authenticated account on the network.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00175 7th percentileScored 2026-11-07
Fix Fixed coder (coder): 2.23.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
codercoderbefore 2.23.02.23.0Patch availableCNA
  • coder Vendorcoder Affected before 2.23.0 Fixed in 2.23.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*——coder
  • cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:* Versions — — ·coder

Remediation

Coder 2.23.0 fixes this issue, so upgrade Coder to version 2.23.0 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA coder (coder) Fixed in 2.23.0

Timeline

  1. 2026-10-18 Threatist record created from CVE-2025-71435
  2. 2026-10-18 Alias added: GHSA-hpmf-3824-qwg6
  3. 2026-10-19 CISA SSVC decision points changed

References

Advisory 1

  • TI-2025-29799 code-server session cookie can be extracted by having user visit specially crafted proxy URL CVSS 3.1HIGH 8.3
  • TI-2025-37344 AgentAPI exposed user chat history via a DNS rebinding attack CVSS 3.1MEDIUM 6.5
  • TI-2026-34071 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft CVSS 3.1CRITICAL 9.1
  • TI-2026-32394 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent CVSS 3.1HIGH 8.8
  • TI-2026-27585 Code Extension Marketplace has a Zip Slip Path Traversal CVSS 4.0HIGH 8.7
  • TI-2024-18523 Coder's OIDC authentication allows email with partially matching domain to register CVSS 3.1HIGH 8.2
See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences