Executive brief
Coder, a platform for managing remote development environments, contains a flaw where suspended users can still access certain AI Bridge proxy services. While an administrator may have deactivated a user's account, any previously issued and unexpired API keys remain functional for these specific endpoints. This could allow a former employee or unauthorized user to continue using company resources until their specific API keys are manually deleted or expire.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Coder's AI Bridge proxy endpoints. The authentication logic in `Server.IsAuthorized` within `coderd/aibridgedserver` validates API key format, expiration, and secrets, but fails to verify the 'active' status of the user account. Consequently, account suspension does not automatically invalidate existing session tokens or API keys for these specific endpoints. An attacker with a previously issued, unexpired API key can continue to proxy requests through the AI Bridge despite being suspended. This issue is resolved in versions 2.32.7, 2.33.8, and 2.34.2.
Affected products
- Coder Coder >= 2.30.0, < 2.32.7; >= 2.33.0, < 2.33.8; >= 2.34.0, < 2.34.2
Timeline
- 2026-06-09: patched: Fix committed to main branch
- 2026-06-11: advisory: Security release tags v2.32.7, v2.33.8, and v2.34.2 published
- 2026-07-07: disclosed: CVE-2026-55435 published to NVD
References
- https://github.com/coder/coder/commit/0d2c9f904a8b75b888140fcc8fbf4633660cc787
- https://github.com/coder/coder/pull/26164
- https://github.com/coder/coder/pull/26173
- https://github.com/coder/coder/releases/tag/v2.32.7
- https://github.com/coder/coder/releases/tag/v2.33.8
- https://github.com/coder/coder/releases/tag/v2.34.2
- https://github.com/coder/coder/security/advisories/GHSA-wqxv-w64v-5wh6