CVE-2026-55075: Anthropic Python OIDC auth bypass

Q: Is CVE-2026-55075 actively exploited?

No confirmed active exploitation of CVE-2026-55075 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55075?

Patch immediately to the version matching your release line: 2.34.2, 2.33.8, 2.32.7, or 2.29.17 (ESR). If patching is delayed, apply the vendor workaround: configure the OIDC identity provider to disallow self-registration and to require email verification before issuing tokens to Coder. Detection guidance: audit which Coder accounts were linked to an IdP subject via the email fallback path (rather than an explicit first-time link) and review any recent logins from unfamiliar or unexpected IdP subjects on high-value accounts; treat any account not yet linked to a specific IdP identity as at-risk until patched.

Q: What systems are affected by CVE-2026-55075?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, AI development workspaces, agent frameworks.

Q: What is the CVSS score for CVE-2026-55075?

CVE-2026-55075 has a CVSS v3.1 base score of 7.4 (HIGH). The EPSS exploitation probability is 0.29%.

CISO Take

Two chained flaws in Coder's OIDC login — an email-fallback account-linking bug and a permissive email_verified check that treats absent or malformed claims as verified — let an attacker who controls a matching email at the configured identity provider log in as a victim and take over their account. This isn't a drive-by internet exploit: it requires the attacker to authenticate at your own OIDC provider with an email matching a target's Coder account, and only works against accounts not yet linked to a different IdP subject, which is why the CVSS lands at 7.4 (AC:H) rather than critical. There's no CISA KEV listing, no EPSS score, and no public exploit or scanner template yet, so this reads as targeted-risk rather than mass-exploitation risk — but Coder sits upstream of 5,435 downstream dependents and is commonly used to provision AI/ML development workspaces holding source code, secrets, and LLM API keys, so a successful takeover has real blast radius. Patch to 2.34.2, 2.33.8, 2.32.7, or 2.29.17 (ESR) depending on your release line; until then, configure your OIDC provider to require email verification before issuing tokens and disable self-registration.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High severity (CVSS 7.4) but conditionally exploitable: the attacker needs the ability to authenticate at the victim organization's own OIDC provider using an email address that matches an existing Coder user, and that user must not already be linked to a different IdP subject (e.g., first-time or legacy-linked accounts are the exposed population). Organizations whose OIDC provider allows self-registration or issues tokens without a reliable email_verified claim are most exposed. No CISA KEV entry, no EPSS percentile, and no known public exploit or Nuclei template lower the probability of opportunistic mass exploitation in the near term, but the impact — full account takeover with access to workspaces, templates, and resources — makes this attractive for targeted attacks (e.g., insider-adjacent or social-engineering-assisted email spoofing at a permissive IdP).

How does the attack unfold?

Initial Access Staging

Attacker identifies a victim's Coder account email and authenticates at the organization's OIDC provider using a matching, self-registered or unverified email address.

AML.T0021

Authentication Bypass

Coder's login flow links the attacker's IdP identity to the victim's account via the email fallback and trusts the absent/non-boolean email_verified claim as true, granting a session as the victim.

AML.T0012

Impact

Attacker gains full access to the victim's Coder workspaces, templates, and resources, exposing any AI/ML training pipelines, notebooks, or embedded LLM API credentials hosted there.

AML.T0008.000

Initial Access Staging

Attacker identifies a victim's Coder account email and authenticates at the organization's OIDC provider using a matching, self-registered or unverified email address.

AML.T0021

Authentication Bypass

Coder's login flow links the attacker's IdP identity to the victim's account via the email fallback and trusts the absent/non-boolean email_verified claim as true, granting a session as the victim.

AML.T0012

Impact

Attacker gains full access to the victim's Coder workspaces, templates, and resources, exposing any AI/ML training pipelines, notebooks, or embedded LLM API credentials hosted there.

AML.T0008.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	go	>= 2.34.0, < 2.34.2	`2.34.2`
3.8K 5.2K dependents Pushed 2d ago 90% patched ~11d to patch Full package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

7.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C High

I High

A None

What should I do?

1 step

Patch immediately to the version matching your release line: 2.34.2, 2.33.8, 2.32.7, or 2.29.17 (ESR). If patching is delayed, apply the vendor workaround: configure the OIDC identity provider to disallow self-registration and to require email verification before issuing tokens to Coder. Detection guidance: audit which Coder accounts were linked to an IdP subject via the email fallback path (rather than an explicit first-time link) and review any recent logins from unfamiliar or unexpected IdP subjects on high-value accounts; treat any account not yet linked to a specific IdP identity as at-risk until patched.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Privacy Violation Agent Training Data AML.T0008.000 - AI Development Workspaces AML.T0012 - Valid Accounts AML.T0021 - Establish Accounts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - Access control for AI system resources

NIST AI RMF

GOVERN 6.1 - Third-party AI risk governance

Frequently Asked Questions

What is CVE-2026-55075?

Two chained flaws in Coder's OIDC login — an email-fallback account-linking bug and a permissive email_verified check that treats absent or malformed claims as verified — let an attacker who controls a matching email at the configured identity provider log in as a victim and take over their account. This isn't a drive-by internet exploit: it requires the attacker to authenticate at your own OIDC provider with an email matching a target's Coder account, and only works against accounts not yet linked to a different IdP subject, which is why the CVSS lands at 7.4 (AC:H) rather than critical. There's no CISA KEV listing, no EPSS score, and no public exploit or scanner template yet, so this reads as targeted-risk rather than mass-exploitation risk — but Coder sits upstream of 5,435 downstream dependents and is commonly used to provision AI/ML development workspaces holding source code, secrets, and LLM API keys, so a successful takeover has real blast radius. Patch to 2.34.2, 2.33.8, 2.32.7, or 2.29.17 (ESR) depending on your release line; until then, configure your OIDC provider to require email verification before issuing tokens and disable self-registration.

Is CVE-2026-55075 actively exploited?

No confirmed active exploitation of CVE-2026-55075 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55075?

Patch immediately to the version matching your release line: 2.34.2, 2.33.8, 2.32.7, or 2.29.17 (ESR). If patching is delayed, apply the vendor workaround: configure the OIDC identity provider to disallow self-registration and to require email verification before issuing tokens to Coder. Detection guidance: audit which Coder accounts were linked to an IdP subject via the email fallback path (rather than an explicit first-time link) and review any recent logins from unfamiliar or unexpected IdP subjects on high-value accounts; treat any account not yet linked to a specific IdP identity as at-risk until patched.

What systems are affected by CVE-2026-55075?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, AI development workspaces, agent frameworks.

What is the CVSS score for CVE-2026-55075?

CVE-2026-55075 has a CVSS v3.1 base score of 7.4 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

training pipelinesAI development workspacesagent frameworks

MITRE ATLAS Techniques

AML.T0008.000 AI Development Workspaces

AML.T0012 Valid Accounts

AML.T0021 Establish Accounts

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: GOVERN 6.1

What are the technical details?

Original Advisory

### Summary Two flaws in Coder's OIDC login chained into account takeover: email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean `false` so an absent or non-boolean claim was treated as verified. ### Impact An attacker who could authenticate at the configured OIDC provider with an email matching a victim's Coder account could log in as that victim and gain full access to their workspaces, templates and resources. This required OIDC authentication, attacker control of a matching email at the IdP and a victim account not yet linked to a different IdP subject. ### Patches The fix restricts the email fallback to first-time and legacy linking and defaults `email_verified` to false when the claim is absent or of an unexpected type. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens. ### Resources - Fix: #25712, #25713 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22450) for independently disclosing this issue!

Exploitation Scenario

An attacker identifies a target's Coder account email (e.g., via corporate email pattern guessing or OSINT) and confirms the victim hasn't yet linked their Coder account to a specific IdP subject. The attacker then authenticates at the organization's configured OIDC provider using that same email address — either because the IdP allows self-registration with an unverified email or issues a token where the email_verified claim is absent or a non-boolean value. Coder's login flow, prior to the patch, falls back to linking by email alone and treats the missing/malformed email_verified claim as true, so it links the attacker's IdP identity to the victim's existing Coder account and logs the attacker in as the victim. From there the attacker has full access to the victim's workspaces, templates, and resources — including any AI/ML training pipelines, notebooks, or embedded LLM API credentials stored in that environment.

Weaknesses (CWE)

CWE-287 Improper Authentication Primary CWE-289 Authentication Bypass by Alternate Name Primary CWE-287 Improper Authentication CWE-289 Authentication Bypass by Alternate Name

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.