All vulnerabilities
CVE-2026-111931GHSA-98qx-9p2x-c4wh

Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy

coder coder
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.34.8Fixed versionCVE List
Published17 Oct 2026Updated 18 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.

Text from CVE List

Affected versions 2

  • coderaffected: 2.0.0 before 2.34.8CVE List
  • coderunaffected: 2.34.8CVE List

References 2