Description
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.
Published: 2026-10-17
Score: 2.3 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.
Title Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
First Time appeared Coder
Coder coder
Weaknesses CWE-613
CPEs cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*
Vendors & Products Coder
Coder coder
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Coder Coder
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-17T18:46:07.735Z

Reserved: 2026-10-17T12:21:54.730Z

Link: CVE-2025-71435

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-17T19:16:28.683

Modified: 2026-10-17T19:16:28.683

Link: CVE-2025-71435

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses