PkgSeer

Vulnerability GO-2025-3921

Unknown

1 year ago

Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

v0.1.0 - v0.27.3

Summary

Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

Details

Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GO-2026-6265

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder

v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GO-2026-6265

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GO-2026-6267

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder

v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GO-2026-6267

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GHSA-h58c-xccx-75m3

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

1 year ago

Fixed (v2.23.0)

1 year ago

Last Modified

7 hours ago