Live › vulnerability › CVE-2026-111931
Go to dashboardCoder versions from 2.0.0 before 2.34.8 do not sanitize the URL path in handleAPIKeySmuggling, so a crafted link on a trusted workspace app subdomain can redirect a user to an external site. An attacker gets a trusted-looking link for phishing, not code execution or direct data access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Coder deployments running versions from 2.0.0 up to but not including 2.34.8 are affected. Exposure depends on workspace app subdomains being reachable by users who could be sent crafted links; deployments without workspace apps on subdomains are less exposed. The sources do not describe further conditions.
No product ranges from the sources yet.
coder version and compare it against 2.34.8.2.34.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.
This page as .md · .json · in your agent: get_signal("CVE-2026-111931")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.