CVE-2025-71435

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/coder/coder/security/advisories/GHSA-3rw9-wmc8-8948
https://www.vulncheck.com/advisories/coder-before-2.23.0-session-expiration-bypass-via-oidc-without-refresh-token

Configurations

No configuration.

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Coder en versiones anteriores a la 2.23.0 contiene una vulnerabilidad de omisión de la caducidad de la sesión que permite a los usuarios autenticados mantener el acceso después de la caducidad del token OIDC cuando no se emite ningún token de actualización. Los usuarios pueden mantener su cookie APIKey activa mediante el uso regular, extendiéndola cada 24 horas para acceder a Coder de forma indefinida después de perder la autorización OIDC.

17 Oct 2026, 19:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-17 19:16

Updated : 2026-10-24 19:10

NVD link : CVE-2025-71435

Mitre link : CVE-2025-71435

CVE.ORG link : CVE-2025-71435

JSON object : View

Products Affected

No product.

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-71435", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71435", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-19T14:39:33.929314Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "0", "lessThan": "2.23.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.23.0", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}]}], "published": "2026-10-17T19:16:28.683", "references": [{"url": "https://github.com/coder/coder/security/advisories/GHSA-3rw9-wmc8-8948", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/coder-before-2.23.0-session-expiration-bypass-via-oidc-without-refresh-token", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization."}, {"lang": "es", "value": "Coder en versiones anteriores a la 2.23.0 contiene una vulnerabilidad de omisi\u00f3n de la caducidad de la sesi\u00f3n que permite a los usuarios autenticados mantener el acceso despu\u00e9s de la caducidad del token OIDC cuando no se emite ning\u00fan token de actualizaci\u00f3n. Los usuarios pueden mantener su cookie APIKey activa mediante el uso regular, extendi\u00e9ndola cada 24 horas para acceder a Coder de forma indefinida despu\u00e9s de perder la autorizaci\u00f3n OIDC."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "disclosure@vulncheck.com"}