CVE-2026-55435CWE-863

Suspended Coder users retain access to AI Bridge LLM proxy endpoints

Medium · published July 7, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, AI Bridge proxy endpoints authenticate via `Server.IsAuthorized` in `coderd/aibridgedserver`, which validates key format, expiry, secret and deleted or system users but does not check whether the account is suspended. Because suspension does not revoke existing API keys, a suspended user's unexpired token keeps working. Practical impact is limited to already-issued API keys of suspended users until those keys are deleted. Versions 2.32.7, 2.33.8, and 2.34.2 patch the issue. As a workaround, on suspension, delete the user's API keys via `DELETE /api/v2/users/{user}/keys`.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00315 · 23.2th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-07T17:37Z
EPSS history
Timeline
  • 07 JUL 17:37Z
    Suspended Coder users retain access to AI Bridge LLM proxy endpoints
    cvelistv5