Coder stores the email of each user and allows OIDC logins to match accounts by email when no existing link with a different IdP subject is found. The code also treats a missing or non‑boolean "email_verified" claim as verified, meaning the assertion that the user had verified their email is no longer enforced. Together these flaws enable an attacker to create a forged OIDC token or use a benign‑looking token to bind an attacker‑controlled email address to a target account. This results in a vulnerability that allows an attacker to gain unauthorized access to a victim’s account via improper handling of OIDC claims (CWE-287, CWE-289).

The weakness exists in the Coder product (coder:coder). Versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2 are affected.

The CVSS score of 7.4 indicates a high severity vulnerability. The EPSS score of <1% indicates a very low but non‑zero exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path involves an attacker controlling an OIDC provider or forging a token that references an email that matches a target account and exploiting the missing email verification check to bind that account to the attacker’s identity. The failure mode is remote through the OIDC authentication flow, which is broadly available to anyone able to craft a token or misuse a provider.