{"id":"GO-2025-3921","revision":"802eaf9c422141f98d3e7eeee22703c1","records":[{"revision":"802eaf9c422141f98d3e7eeee22703c1","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-3921","aliases":["CVE-2025-71435","GHSA-3rw9-wmc8-8948"],"title":"Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder","description":"Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder","state":0,"publishedAt":"2025-09-08T14:13:10+00:00","modifiedAt":"2026-10-18T10:55:50.6537238+00:00","affected":[{"ecosystem":"Go","name":"github.com/coder/coder","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.23.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/coder/coder/security/advisories/GHSA-3rw9-wmc8-8948","https://github.com/coder/coder/commit/1a4160803589034ce1518e24a78f232c8d08f996"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-3921","license":"OSV · upstream source license applies","key":"osv:GO-2025-3921","identifiers":["GO-2025-3921","CVE-2025-71435","GHSA-3rw9-wmc8-8948"]},"retained":false,"historicalAffected":[]}],"coverage":[]}