Live › vulnerability › CVE-2025-71435
Go to dashboardCoder before 2.23.0 does not end a user's session when their OIDC token expires and no refresh token was issued. The user's APIKey cookie is extended on each use, so a user who lost OIDC authorization can keep access to Coder indefinitely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted Coder with OIDC login where the identity provider does not issue refresh tokens. Users removed or deprovisioned upstream may keep access through their APIKey cookie. Installations that use only non-OIDC login are unlikely to be exposed, though the sources do not state this explicitly.
No product ranges from the sources yet.
coder version; versions below 2.23.0 are affected.2.23.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.
This page as .md · .json · in your agent: get_signal("CVE-2025-71435")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.