---
id: CVE-2025-71435
title: Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
summary: >-
  Coder before 2.23.0 contains a session expiration bypass vulnerability that
  allows authenticated users to retain access after OIDC token expiry when no
  refresh token is issued. Users can keep their APIKey cookie active through
  regular us…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-613
vendor: coder
product: coder
affected:
  - coder < 2.23.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T14:39:33.929314Z'
published: '2026-10-17'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T14:40:10.199Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71435'
references:
  - url: 'https://github.com/coder/coder/security/advisories/GHSA-3rw9-wmc8-8948'
    label: GitHub Security Advisory (GHSA-3rw9-wmc8-8948)
  - url: >-
      https://www.vulncheck.com/advisories/coder-before-2.23.0-session-expiration-bypass-via-oidc-without-refresh-token
    label: >-
      VulnCheck Advisory: Coder before 2.23.0 Session Expiration Bypass via OIDC
      Without Refresh Token
  - url: >-
      https://github.com/coder/coder/commit/1a4160803589034ce1518e24a78f232c8d08f996
  - url: 'https://github.com/coder/coder'
tags:
  - cve.org
  - osv
  - go
epss: 0.00175
epssPercentile: 0.06932
aliases:
  - GHSA-3rw9-wmc8-8948
  - GO-2025-3921
ecosystem: go
patched:
  - github.com/coder/coder/v2 2.23.0
ingestedAt: '2026-10-17T19:08:56.994Z'
---

## Overview

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.

## Affected

- `coder < 2.23.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2025-71435)

Affected packages:

- `github.com/coder/coder/v2 < 2.23.0`

Patched in:

- `github.com/coder/coder/v2 2.23.0`

Source: https://osv.dev/vulnerability/GHSA-3rw9-wmc8-8948