Coder’s OpenID Connect (OIDC) authentication flow performed a strict Go boolean type assertion on the returned `email_verified` claim. When an identity provider delivered as the string "false", or omitted it entirely, the assertion failed and the system erroneously treated the email as verified. Because the email address was matched to an existing account when no user matched the claim, an attacker could create or take over an account using an unverified email address, effectively hijacking any user account that shared that email. This flaw is a classic authorization bypass (CWE-287) compounded by a type confusion (CWE-704) and results in loss of confidentiality and integrity of user accounts.

Any deployment of Coder prior to releases 2.29.7, 2.32.7, 2.33.8, or 2.34.2. The vulnerability applies to the OIDC callback handling component of the coder:coder product. Systems running those unpatched versions may allow attackers to create or take over accounts by linking unverified email addresses to existing user identities.

The CVSS score of 7.4 indicates high severity; the EPSS score of <1% suggests the likelihood of exploitation is relatively low. The vulnerability is not listed in CISA’s KEV catalog, but the nature of the flaw—an authentication bypass that can be triggered over standard OIDC traffic—makes it attractive for attackers with access to a compromised IdP claim or who can craft OIDC responses. The attack vector is remote, leveraging normal authentication flows, and does not require elevated privileges or advanced privileges to execute.