CVE-2026-55076
3 advisories.
Go/github.com/coder/coder/v2 CVE-2026-55076: high 7.4
Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
Action: Upgrade github.com/coder/coder/v2 to 2.29.17 or later.
go get github.com/coder/coder/v2@v2.34.2go get github.com/coder/coder/v2@v2.33.8go get github.com/coder/coder/v2@v2.32.7go get github.com/coder/coder/v2@v2.29.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.34.0 | 2.34.2 | - |
| 2.33.0 | 2.33.8 | - |
| 2.30.0 | 2.32.7 | - |
| 0 | 2.29.17 | - |
Fixed versions
| 2.34.2 | 2.33.8 | 2.32.7 | 2.29.17 |
Sources
- osv: GHSA-75vm-6w67-gwvp
- https://github.com/coder/coder/security/advisories/GHSA-75vm-6w67-gwvp
- https://github.com/coder/coder
CVE-2026-55076 · published · modified · JSON
Go/github.com/coder/coder CVE-2026-55076: unknown
Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
CVE-2026-55076 · published · modified · JSON
Go/github.com/coder/coder/v2 CVE-2026-55076: unknown
Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking in github.com/coder/coder
Action: Upgrade github.com/coder/coder/v2 to 2.29.17 or later.
go get github.com/coder/coder/v2@v2.29.17go get github.com/coder/coder/v2@v2.32.7go get github.com/coder/coder/v2@v2.33.8go get github.com/coder/coder/v2@v2.34.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.29.17 | - |
| 2.30.0 | 2.32.7 | - |
| 2.33.0 | 2.33.8 | - |
| 2.34.0 | 2.34.2 | - |
Fixed versions
| 2.29.17 | 2.32.7 | 2.33.8 | 2.34.2 |
Sources
- osv: GO-2026-5907#Go/github.com/coder/coder/v2
- https://github.com/coder/coder/security/advisories/GHSA-75vm-6w67-gwvp
CVE-2026-55076 · published · modified · JSON