CVE-2025-71435

EUVD-2025-211113
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.2 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 6.62%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
codercoder
𝑥
< 2.23.0
CNA
Common Weakness Enumeration
References
https://github.com/coder/coder/security/advisories/GHSA-3rw9-wmc8-8948
https://www.vulncheck.com/advisories/coder-before-2.23.0-session-expiration-bypass-via-oidc-without-refresh-token