CVE-2026-111931: Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy
Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Coder versions from 2.0.0 up to, but not including, 2.34.8 are affected. The issue is in the Workspace App Proxy handling of requests through handleAPIKeySmuggling.
What does an attacker need to exploit this?
An attacker needs to convince a user to follow a crafted link hosted on a trusted workspace app subdomain. The crafted path begins with double slashes, causing a scheme-relative redirect to an attacker-controlled site.
What is the practical impact?
The vulnerability enables phishing by making a malicious destination appear to originate from a trusted workspace app subdomain. The supplied severity vector indicates no confidentiality or availability impact, but a low integrity impact.
How can I determine whether I am exposed?
Check the deployed Coder version and whether workspace app proxy URLs are available to users. Versions earlier than 2.34.8 within the affected range should be treated as vulnerable, particularly if users may follow workspace app links.