CVE-2025-71435
Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
CVSS Score
4.2
EPSS Score
0.0%
EPSS Percentile
0th
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.
| CWE | CWE-613 |
| Vendor | coder |
| Product | coder |
| Published | Oct 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for coder coder
Be the first to know when new medium vulnerabilities affecting coder coder are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
coder / coder
0 < 2.23.0
References
Credits
🔍 spikecurtis