# Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

Coder's azureidentity.Validate() checks the PKCS#7 signer cert chain but never the signature, letting an attacker forge a vmId and steal a workspace agent token.

- Payout: Research
- Severity: critical
- Program: Coder
- Found by: bencalif
- Disclosed: 2026-05-19
- CVE: CVE-2026-46354
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-6x44-w3xg-hqqf
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-6x44-w3xg-hqqf
- Tags: area:cloud domain:api domain:cloud impact:ato impact:data-leak kind:research platform:ghsa sev:critical tech:azure tech:go technique:source-review vuln:access-control vuln:auth-bypass vuln:crypto

**Target:** Unauthenticated API endpoint POST /api/v2/workspaceagents/azure-instance-identity
**Root cause:** azureidentity.Validate() verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature over the content, so arbitrary content is accepted.
**Steps:**
1. Obtain a legitimate Azure IMDS signing certificate (from any Azure VM or public CT logs).
2. Craft a PKCS#7 envelope embedding that certificate with arbitrary content `{"vmId":"<target>"}` and no valid signature.
3. POST the forged envelope to the unauthenticated `POST /api/v2/workspaceagents/azure-instance-identity`.
4. Server accepts the forged vmId and returns the victim workspace agent's session token.
5. Use the token: `GET /workspaceagents/me/gitsshkey` for the Git SSH private key, `GET /workspaceagents/me/external-auth` for OAuth tokens, and the agent manifest for workspace secrets.
**How found:** Code review of azureidentity.Validate() revealed the certificate chain was checked but the PKCS#7 signature verification step was absent, so content integrity was never enforced.
**Exploitation:** Attacker needs only the target VM's vmId (a UUIDv4). With a trusted Azure cert and a forged PKCS#7 envelope, they hit the unauthenticated azure-instance-identity endpoint to receive the victim agent's session token, then pull the Git SSH key, plaintext GitHub/GitLab/Bitbucket OAuth tokens, and workspace secrets (env vars, file paths, API keys).
**Escalation:** Stolen agent token pivots to repository push/impersonation via the Git SSH key and to third-party account access via plaintext OAuth tokens.
**Insight:** When a verifier validates a certificate chain, confirm it also verifies the signature over the signed content — chain trust alone authenticates the signer, not the payload; test by swapping content under a valid cert.