---
id: "CVE-2025-71435"
kind: "vulnerability"
aliases: ["CVE-2025-71435"]
title: "Coder: session expiry bypass keeps revoked OIDC users signed in"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["coder", "infrastructure", "oidc", "self-hosted"]
not_affected_if: ["coder-2.23.0-or-later", "non-oidc-auth"]
published_at: "2026-10-17T19:16:28+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:41:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71435", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Coder: session expiry bypass keeps revoked OIDC users signed in

Coder before 2.23.0 does not end a user's session when their OIDC token expires and no refresh token was issued. The user's APIKey cookie is extended on each use, so a user who lost OIDC authorization can keep access to Coder indefinitely.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Coder server version with `coder version`; versions below `2.23.0` are affected.
- Check whether OIDC login is enabled and whether the identity provider issues refresh tokens for Coder users (unknown from the sources).

## Fix

- Upgrade Coder to `2.23.0` or later.
- Until upgraded, revoke active sessions for users removed from the identity provider (unknown from the sources whether a specific token rotation step is needed).

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-71435

## From the sources

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_