{"action":"Upgrade github.com/coder/coder/v2 to 2.6.1 or later.","affected":[{"fixed":"2.8.4","introduced":"2.8.0"},{"fixed":"2.7.3","introduced":"2.7.0"},{"fixed":"2.6.1","introduced":"0"}],"component":"github.com/coder/coder/v2","cve_ids":["CVE-2024-27918"],"ecosystem":"Go","epss":0.00965,"exploited":false,"fixed_versions":["2.8.4","2.7.3","2.6.1"],"ghsa_id":"GHSA-7cc2-r658-7xpf","id":"tcs_01M5KF1RSKGCWG9PJBWSTXM7PF","modified_at":"2026-09-10T03:50:10.195084904Z","published_at":"2024-03-04T20:45:36Z","references":["https://osv.dev/vulnerability/GHSA-7cc2-r658-7xpf","https://github.com/coder/coder/security/advisories/GHSA-7cc2-r658-7xpf","https://nvd.nist.gov/vuln/detail/CVE-2024-27918","https://github.com/coder/coder/commit/1171ce7add017481d28441575024209ac160ecb0","https://github.com/coder/coder/commit/2ba84911f8b02605e5958d5e4a2fe3979ec50b31","https://github.com/coder/coder/commit/2d37eb42e7db656e343fe1f36de5ab1a1a62f4fb","https://github.com/coder/coder/commit/4439a920e454a82565e445e4376c669e3b89591c","https://github.com/coder/coder"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-7cc2-r658-7xpf","url":"https://osv.dev/vulnerability/GHSA-7cc2-r658-7xpf"}],"summary":"Coder's OIDC authentication allows email with partially matching domain to register"}