CVE-2024-27918

Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the `CODER_OIDC_EMAIL_DOMAIN` verification and create an account with an email not in the allowlist. Deployments are only affected if the OIDC provider allows users to create accounts on the provider. During OIDC registration, the user's email was improperly validated against the allowed `CODER_OIDC_EMAIL_DOMAIN`s. This could allow a user with a domain that only partially matched an allowed domain to successfully login or register. An attacker could register a domain name that exploited this vulnerability and register on a Coder instance with a public OIDC provider. Coder instances with OIDC enabled and protected by the `CODER_OIDC_EMAIL_DOMAIN` configuration are affected. Coder instances using a private OIDC provider are not affected, as arbitrary users cannot register through a private OIDC provider without first having an account on the provider. Public OIDC providers are impacted. GitHub authentication and external authentication are not impacted. This vulnerability is remedied in versions 2.8.4, 2.7.3, and 2.6.1 All versions prior to these patches are affected by the vulnerability.*It is recommended that customers upgrade their deployments as soon as possible if they are utilizing OIDC authentication with the `CODER_OIDC_EMAIL_DOMAIN` setting.

• CWE-20

• https://github.com/coder/coder/commit/1171ce7add017481d28441575024209ac160ecb0Patch
• https://github.com/coder/coder/commit/2ba84911f8b02605e5958d5e4a2fe3979ec50b31Patch
• https://github.com/coder/coder/commit/2d37eb42e7db656e343fe1f36de5ab1a1a62f4fbPatch
• https://github.com/coder/coder/commit/4439a920e454a82565e445e4376c669e3b89591cPatch
• https://github.com/coder/coder/security/advisories/GHSA-7cc2-r658-7xpfVendor Advisory
• https://github.com/coder/coder/commit/1171ce7add017481d28441575024209ac160ecb0Patch
• https://github.com/coder/coder/commit/2ba84911f8b02605e5958d5e4a2fe3979ec50b31Patch
• https://github.com/coder/coder/commit/2d37eb42e7db656e343fe1f36de5ab1a1a62f4fbPatch
• https://github.com/coder/coder/commit/4439a920e454a82565e445e4376c669e3b89591cPatch
• https://github.com/coder/coder/security/advisories/GHSA-7cc2-r658-7xpfVendor Advisory

Published

Mar 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-27912A denial of service vulnerability was reported in some Lenov…7.5
• CVE-2024-27913ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) throu…6.5
• CVE-2024-27914GLPI is a Free Asset and IT Management Software package, Dat…6.1
• CVE-2024-27915Sulu is a PHP content management system. Starting in verson …8.1
• CVE-2024-27916Minder is a software supply chain security platform. Prior t…4.3
• CVE-2024-27917Shopware is an open commerce platform based on Symfony Frame…7.5
• CVE-2024-27919Envoy is a cloud-native, open-source edge and service proxy.…7.5
• CVE-2024-2792The Elementor Addon Elements plugin for WordPress is vulnera…6.4
• CVE-2024-27920projectdiscovery/nuclei is a fast and customisable vulnerabi…7.4
• CVE-2024-27921Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-27922TOMP Bare Server implements the TompHTTP bare server. A vuln…9.8
• CVE-2024-27923Grav is a content management system (CMS). Prior to version …8.8