AI Threat Alert
Coder's OIDC login handler checked the email_verified claim with a naive Go bool assertion, so an IdP returning that claim as a string or omitting it entirely caused the check to silently fail open, treating the email as verified. Because Coder falls back to matching accounts purely by email, an attacker who simply registered the victim's corporate email at a compatible identity provider — without ever proving ownership of that inbox — could log in via OIDC and land a session for the victim's existing Coder account, no prior credentials required. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, but the bug sits in a self-hosted dev environment platform with 5,435 downstream dependents, and account takeover on a developer workspace platform typically means access to source code, secrets, and cloud credentials. Patch to v2.34.2, v2.33.8, v2.32.7, or v2.29.17 depending on your release line; there is no configuration-only workaround for the email-fallback issue, so upgrading is mandatory. In the interim, review OIDC login logs for accounts whose IdP subject changed or that logged in without a prior session, since the patch now blocks the fallback when a different IdP subject is already linked.
What is the risk?
CVSS 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects high confidentiality and integrity impact gated by high attack complexity: the attacker needs a compatible IdP that will let them register or control the victim's email address without verification, which is a real-world but non-trivial precondition and not exploitable against every OIDC configuration. No EPSS data, no CISA KEV listing, and no public PoC or scanner template exist, so there is no evidence of active or automated exploitation today. However, the flaw requires zero prior authentication and zero user interaction from the victim, and the impact is full account takeover rather than partial data exposure, which is a severe outcome for any organization using OIDC-based SSO into Coder. Organizations using a permissive or federated IdP (e.g., allowing self-service registration or unverified social logins) are at meaningfully higher exposure than those using tightly controlled corporate IdPs that always emit a native boolean email_verified claim.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Anthropic Python | go | >= 2.34.0, < 2.34.2 | 2.34.2 |
Do you use Anthropic Python? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
Upgrade immediately to the patched version for your release line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 (2.29 ESR) — these coerce email_verified across bool/string/numeric types and block email-fallback linking when a different IdP subject is already associated with the matched account. There is no workaround for the fallback-linking issue itself; patching is mandatory. As a defense-in-depth step, confirm your IdP configuration emits email_verified as a native JSON boolean (not a string) even pre-patch, since that avoids triggering the fail-open path. For detection, audit Coder's OIDC login and account-linking logs for sessions where the linked IdP subject changed unexpectedly or where a login occurred without the corresponding user having previously used that IdP, and alert on any workspace access from unfamiliar source IPs immediately following an OIDC login.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-55076?
Coder's OIDC login handler checked the email_verified claim with a naive Go bool assertion, so an IdP returning that claim as a string or omitting it entirely caused the check to silently fail open, treating the email as verified. Because Coder falls back to matching accounts purely by email, an attacker who simply registered the victim's corporate email at a compatible identity provider — without ever proving ownership of that inbox — could log in via OIDC and land a session for the victim's existing Coder account, no prior credentials required. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, but the bug sits in a self-hosted dev environment platform with 5,435 downstream dependents, and account takeover on a developer workspace platform typically means access to source code, secrets, and cloud credentials. Patch to v2.34.2, v2.33.8, v2.32.7, or v2.29.17 depending on your release line; there is no configuration-only workaround for the email-fallback issue, so upgrading is mandatory. In the interim, review OIDC login logs for accounts whose IdP subject changed or that logged in without a prior session, since the patch now blocks the fallback when a different IdP subject is already linked.
Is CVE-2026-55076 actively exploited?
No confirmed active exploitation of CVE-2026-55076 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-55076?
Upgrade immediately to the patched version for your release line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 (2.29 ESR) — these coerce email_verified across bool/string/numeric types and block email-fallback linking when a different IdP subject is already associated with the matched account. There is no workaround for the fallback-linking issue itself; patching is mandatory. As a defense-in-depth step, confirm your IdP configuration emits email_verified as a native JSON boolean (not a string) even pre-patch, since that avoids triggering the fail-open path. For detection, audit Coder's OIDC login and account-linking logs for sessions where the linked IdP subject changed unexpectedly or where a login occurred without the corresponding user having previously used that IdP, and alert on any workspace access from unfamiliar source IPs immediately following an OIDC login.
What systems are affected by CVE-2026-55076?
This vulnerability affects the following AI/ML architecture patterns: AI development workspaces, agent frameworks.
What is the CVSS score for CVE-2026-55076?
CVE-2026-55076 has a CVSS v3.1 base score of 7.4 (HIGH). The EPSS exploitation probability is 0.48%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0008.000 AI Development Workspaces AML.T0012 Valid Accounts AML.T0049 Exploit Public-Facing Application Compliance Controls Affected
What are the technical details?
Original Advisory
### Summary Coder's OIDC callback checked `email_verified` with a direct Go `bool` type assertion. When an IdP returned the claim as a non-boolean (for example the string `"false"`) or omitted it, the assertion failed open and the email was treated as verified. Combined with an unconditional email-based account fallback, this enabled account takeover. ### Impact An attacker who registered a victim's email at a compatible IdP without verifying it could log in via OIDC and be matched to the victim's existing Coder account, receiving a session for that account. No prior authentication to Coder was required and the result was full account takeover. ### Patches The fix coerces `email_verified` across bool, string and numeric types (fail-closed) and blocks the email fallback when the matched user already has a different linked IdP subject. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Ensure the IdP returns `email_verified` as a native JSON boolean. The email-fallback linking issue has no configuration workaround; upgrading is required. ### Resources - Fix: #25712, #25713 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22444) for independently disclosing this issue!
Exploitation Scenario
An attacker targets a CISO or ML engineer at a company that federates Coder login through an OIDC provider allowing low-friction account creation (e.g., a partner identity broker or an IdP that doesn't enforce email verification before token issuance). The attacker registers a new account at that IdP using the victim's known corporate email address without ever proving they control that inbox. The IdP issues an ID token where email_verified is returned as the string "false" or omitted — a value the vulnerable Go type assertion cannot handle, so it silently defaults to "true" (verified). The attacker completes the OIDC flow against Coder, which — thanks to the unconditional email-based fallback — matches the token's email to the victim's existing Coder account and issues the attacker a live session for that account, with no password, MFA, or prior authentication ever required. The attacker now operates inside the victim's development workspace, exfiltrating source code, cloud credentials, and any AI/ML pipeline secrets or model artifacts staged there.
Weaknesses (CWE)
CWE-287 Improper Authentication
Primary
CWE-704 Incorrect Type Conversion or Cast
Primary
CWE-287 Improper Authentication CWE-704 Incorrect Type Conversion or Cast CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- [Architecture and Design] Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N References
Timeline
Related Vulnerabilities
CVE-2026-27775 8.8 Gitea: cached permission check allows repo takeover
Same package: anthropic CVE-2026-54449 8.8 LangBot: RCE via arbitrary STDIO MCP command
Same package: anthropic CVE-2026-7574 8.7 Claude Desktop: VM integrity bypass enables RCE
Same package: anthropic CVE-2026-55429 8.7 Coder: cross-workspace agent hijack via app ID reuse
Same package: anthropic CVE-2026-67428 8.5 Flyto2 Core: SSRF via unvalidated URLs in agent tools
Same package: anthropic