CVE-2026-111931
Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 17, 2026
- Updated
- Oct 18, 2026
- Reserved
- Oct 17, 2026
Description
Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected Products
| Product | Versions |
|---|---|
codercoder |
|
References
- GitHub Security Advisory (GHSA-98qx-9p2x-c4wh)vendor-advisory
- VulnCheck Advisory: Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.