Vulnerability · CVE-2025-71435
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued.
Published Aug 28, 2025 · catalog updated Oct 18, 2026 · Coder before 2.23.0 contains
Open the advisory
Exploitation likelihood is not on this record for CVE-2025-71435. A missing EPSS score is not a low risk. Compare Coder before 2.23.0 contains with the linked advisory before you change production.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (Coder before 2.23.0 contains).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- EPSS is missing. A missing score is not a low risk.
- Severity
- Low2.3
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- Not in the current FIRST EPSS dataset
- Remediation
- Advisory link
- Affected products
- Go github.com/coder/coder · Go github.com/coder/coder/v2
### Summary If users log in to Coder via OIDC, and the OpenID Identity Provider does not return a refresh token, then Coder may allow their web session to continue beyond the expiration of the token returned by the OpenID Identity Provider. ### Details When a user logs in via OIDC, Coder stores the OIDC token and refresh token (if any) in its datastore and sets an APIKey in the user's cookies. If there is a refresh token, then when the OIDC token is expired and a request is made with the APIKey, we attempt to refresh the OIDC token. If refresh fails, the Coder API request is also failed and the user needs to log in again. However, if there is no refresh token provided, then affected versions of Coder fail to enforce the expiry of the OIDC token, and allow users to make API requests even if it is expired so long as their APIKey stored in cookies has not expired. Coder APIKeys have an expiry and lifetime of 24 hours, but Coder is configured to extend the lifetime of the APIKey by up to 24 hours from the time it is used successfully. So, an APIKey that is used at least once every 24 hours will not expire. (This behavior can be disabled by configuration). ### Impact This could allow a user to access the Coder service beyond the lifetime of the token issued by the OpenID provider, potentially indefinitely, even if they are no loner authorized via OIDC.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Go github.com/coder/coderversion unspecified
- Go github.com/coder/coder/v20 → 2.23.0
How to fix CVE-2025-71435
Recommended remediation
A patch or advisory reference is linked. Open the original publisher for availability by product version.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
Exploitation likelihood is not on this record for CVE-2025-71435. A missing EPSS score is not a low risk. Compare Coder before 2.23.0 contains with the linked advisory before you change production.
Which versions are affected?
Compare what you have installed with 0 → 2.23.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-324; CWE-613: Insufficient Session Expiration. EPSS is absent from the current FIRST dataset. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 17, 2026 · NIST NVD
Detected
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.
Oct 18, 2026 · GitHub Advisory Database
Fix available
github.com/coder/coder/v2 fixed in 2.23.0
Oct 18, 2026 · GitHub Advisory Database
Fix available
github.com/coder/coder/v2 fixed in 2.23.0
Oct 18, 2026 · GitHub Advisory Database
Updated
### Summary If users log in to Coder via OIDC, and the OpenID Identity Provider does not return a refresh token, then Coder may allow their web session to continue beyond the expiration of the token returned by the OpenID Identity Provider. ### Details When a user logs in via OIDC, Coder stores the OIDC token and refresh token (if any) in its datastore and sets an APIKey in the user's cookies. If
Sources
- CVE.orgVulnerability recordCVE-2025-71435
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-3rw9-wmc8-8948
GitHub Advisory Database record mirrored by OSV.
github.com - Go Vulnerability DatabasePackage advisoryGHSA-3rw9-wmc8-8948
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token
osv.dev - Go Vulnerability DatabasePackage advisoryGO-2025-3921
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder
osv.dev - NIST NVDVulnerability recordCVE-2025-71435
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Co
nvd.nist.gov - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-3rw9-wmc8-8948
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token
osv.dev - OpenSSF OSV / OSV ScannerPackage advisoryGO-2025-3921
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder
osv.dev
References
Freshness
Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.