CVE-2025-71435CWE-613

CVE-2025-71435

Medium · published October 17, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
6.6
In the wild
Unconfirmed
What it is

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00175 · 6.6th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-10-17T23:16Z
References (2)
https://github.com/coder/coder/security/advisories/GHSA-3rw9-wmc8-8948 · [email protected]https://www.vulncheck.com/advisories/coder-before-2.23.0-session-expiration-bypass-via-oidc-without-refresh-token · [email protected]
EPSS history
Timeline
  • 19 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 17 OCT 18:46Z
    Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
    cvelistv5
  • 17 OCT 18:46Z
    Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
    cvelistv5