{"id":"CVE-2025-71435","kind":"vulnerability","aliases":["CVE-2025-71435"],"related":[],"title":"Coder: session expiry bypass keeps revoked OIDC users signed in","description":"Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.","summary":"Coder before 2.23.0 does not end a user's session when their OIDC token expires and no refresh token was issued. The user's APIKey cookie is extended on each use, so a user who lost OIDC authorization can keep access to Coder indefinitely.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coder","infrastructure","oidc","self-hosted"],"not_affected_if":["coder-2.23.0-or-later","non-oidc-auth"],"how_to_check":"- Check the Coder server version with `coder version`; versions below `2.23.0` are affected.\n- Check whether OIDC login is enabled and whether the identity provider issues refresh tokens for Coder users (unknown from the sources).","fix":"- Upgrade Coder to `2.23.0` or later.\n- Until upgraded, revoke active sessions for users removed from the identity provider (unknown from the sources whether a specific token rotation step is needed).","status":"open","published_at":"2026-10-17T19:16:28+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:41:43+00:00","updated_at":"2026-10-25T04:41:43+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:41:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Coder to `2.23.0` or later.\n- Until upgraded, revoke active sessions for users removed from the identity provider (unknown from the sources whether a specific token rotation step is needed).","reach":"network","title":"Coder: session expiry bypass keeps revoked OIDC users signed in","impact":"medium","summary":"Coder before 2.23.0 does not end a user's session when their OIDC token expires and no refresh token was issued. The user's APIKey cookie is extended on each use, so a user who lost OIDC authorization can keep access to Coder indefinitely.","category":"infrastructure","nicknames":[],"who_cares":["coder","self-hosted","oidc"],"confidence":0.6,"needs_auth":"yes","worst_case":"Former users keep indefinite access to the Coder instance.","analyst_note":"","how_to_check":"- Check the Coder server version with `coder version`; versions below `2.23.0` are affected.\n- Check whether OIDC login is enabled and whether the identity provider issues refresh tokens for Coder users (unknown from the sources).","needs_analyst":false,"not_affected_if":["non-oidc-auth","coder-2.23.0-or-later"],"who_is_affected":"Teams running self-hosted Coder with OIDC login where the identity provider does not issue refresh tokens. Users removed or deprovisioned upstream may keep access through their APIKey cookie. Installations that use only non-OIDC login are unlikely to be exposed, though the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3324,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':11A,14A '-71435':12A,15A '2.23.0':24B,68C '24':105C 'access':62B,81C,108C 'activ':98C 'allow':76C 'apikey':46B,96C 'authent':77C 'author':59B,114C 'bypass':4A,73C 'coder':1A,16B,22B,64B,66C,109C 'contain':69C 'cooki':47B,97C 'cve':10A,13A 'end':27B 'everi':104C 'expir':36B,72C 'expiri':3A,85C 'extend':49B,102C 'host':21B 'hour':106C 'indefinit':65B,110C 'infrastructur':17B 'issu':42B,91C 'keep':5A,61B,94C 'lose':112C 'lost':57B 'oidc':7A,18B,34B,58B,83C,113C 'refresh':39B,88C 'regular':100C 'retain':80C 'revok':6A 'self':20B 'self-host':19B 'session':2A,31B,71C 'sign':9A 'token':35B,40B,84C,89C 'use':52B,101C 'user':8A,29B,44B,55B,78C,92C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Coder with OIDC login where the identity provider does not issue refresh tokens. Users removed or deprovisioned upstream may keep access through their APIKey cookie. Installations that use only non-OIDC login are unlikely to be exposed, though the sources do not state this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-71435","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71435","severity":null,"published_at":"2026-10-17T19:16:28+00:00","modified_at":"2026-10-19T22:10:00+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}