Vulnerability Report: GO-2025-3921
- GHSA-3rw9-wmc8-8948
- Affects: github.com/coder/coder, github.com/coder/coder/v2
- Published: Sep 08, 2025
- Unreviewed
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder
For detailed information about this vulnerability, visithttps://github.com/coder/coder/security/advisories/GHSA-3rw9-wmc8-8948.
Affected Modules
- PathGo Versions
- all versions, no known fixed
- before v2.23.0
Aliases
References
- https://github.com/coder/coder/security/advisories/GHSA-3rw9-wmc8-8948
- https://github.com/coder/coder/commit/1a4160803589034ce1518e24a78f232c8d08f996
- https://vuln.go.dev/ID/GO-2025-3921.json
Feedback
This report isunreviewed. It was automatically generated from a third-party source and its details have not been verified by the Go team.
See anything missing or incorrect? Suggest an edit to this report.