Coder software versions prior to 2.23.0 contain a flaw that lets authenticated users maintain access after their OpenID Connect token expires when no refresh token is issued. The vulnerability is caused by the APIKey cookie remaining active with each normal request, automatically extending the cookie’s lifetime by 24 hours. As a result, a user who has lost OIDC authorization can keep using the system for an arbitrary amount of time, effectively bypassing session expiration controls.

The issue affects only the Coder product from coder, specifically all revisions before version 2.23.0. Any installation that relies on OIDC authentication without a refresh token and uses the default APIKey cookie mechanism is vulnerable. The vulnerability has not been reported to affect external or third‑party vendors or customized builds unless they use the same authentication flow.

The CVSS score of 2.3 rates the vulnerability as low, and the EPSS score is not available, indicating no known high exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user to be authenticated and to continue interacting with the application, which allows the attacker to keep the APIKey cookie valid and retain access even after their original OpenID token has expired. The attack surface is limited to authenticated users and does not provide remote code execution or privilege escalation.