CVE-2026-55076: Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

July 6, 2026

Coder’s OIDC callback checked email_verified with a direct Go bool type assertion. When an IdP returned the claim as a non-boolean (for example the string "false") or omitted it, the assertion failed open and the email was treated as verified. Combined with an unconditional email-based account fallback, this enabled account takeover.

References

github.com/advisories/GHSA-75vm-6w67-gwvp
github.com/coder/coder/security/advisories/GHSA-75vm-6w67-gwvp
nvd.nist.gov/vuln/detail/CVE-2026-55076

Code Behaviors & Features

Detect and mitigate CVE-2026-55076 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →