{"id":"CVE-2026-111931","kind":"vulnerability","aliases":["CVE-2026-111931"],"related":[],"title":"Coder: open redirect in API key handling sends users to attacker sites","description":"Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.","summary":"Coder versions from 2.0.0 before 2.34.8 do not sanitize the URL path in handleAPIKeySmuggling, so a crafted link on a trusted workspace app subdomain can redirect a user to an external site. An attacker gets a trusted-looking link for phishing, not code execution or direct data access.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coder","infrastructure","self-hosted","workspace-apps"],"not_affected_if":["coder-2.34.8-or-later"],"how_to_check":"- Check the installed Coder version with `coder version` and compare it against `2.34.8`.\n- Confirm whether the deployment serves workspace apps on subdomains, since the redirect is reached through those subdomains.","fix":"- Upgrade Coder to `2.34.8` or later.\n- unknown for interim mitigations.","status":"open","published_at":"2026-10-17T19:16:36+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:26:48+00:00","updated_at":"2026-10-25T04:26:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:26:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Coder to `2.34.8` or later.\n- unknown for interim mitigations.","reach":"internet","title":"Coder: open redirect in API key handling sends users to attacker sites","impact":"low","summary":"Coder versions from 2.0.0 before 2.34.8 do not sanitize the URL path in handleAPIKeySmuggling, so a crafted link on a trusted workspace app subdomain can redirect a user to an external site. An attacker gets a trusted-looking link for phishing, not code execution or direct data access.","category":"infrastructure","nicknames":[],"who_cares":["coder","self-hosted","workspace-apps"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Users are redirected to attacker sites for phishing.","analyst_note":"","how_to_check":"- Check the installed Coder version with `coder version` and compare it against `2.34.8`.\n- Confirm whether the deployment serves workspace apps on subdomains, since the redirect is reached through those subdomains.","needs_analyst":false,"not_affected_if":["coder-2.34.8-or-later"],"who_is_affected":"Coder deployments running versions from 2.0.0 up to but not including 2.34.8 are affected. Exposure depends on workspace app subdomains being reachable by users who could be sent crafted links; deployments without workspace apps on subdomains are less exposed. The sources do not describe further conditions.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000603,"input_tokens":3354,"output_tokens":536,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111931':15A,18A '-2026':14A,17A '2.0.0':30B,78C '2.34.8':32B,80C 'access':75B 'allow':89C 'api':5A 'app':26B,49B,106C 'attack':11A,60B,90C,99C,121C 'becom':115C 'begin':110C 'code':70B 'coder':1A,19B,27B,76C 'contain':81C 'craft':43B,101C 'cve':13A,16A 'data':74B 'direct':73B 'doubl':112C 'execut':71B 'extern':57B,94C 'get':61B 'handl':7A 'handleapikeysmuggl':40B,87C 'host':23B 'infrastructur':20B 'key':6A 'link':44B,66B,102C 'look':65B 'open':2A,83C 'path':38B,109C 'phish':68B,124C 'r.url.path':97C 'redirect':3A,52B,84C,92C,119C 'relat':118C 'sanit':35B 'scheme':117C 'scheme-rel':116C 'self':22B 'self-host':21B 'send':8A 'site':12A,58B,122C 'slash':113C 'subdomain':50B,107C 'trust':47B,64B,104C 'trusted-look':63B 'unsanit':96C 'url':37B 'user':9A,54B,93C 'valu':98C 'version':28B 'via':95C 'vulner':85C 'workspac':25B,48B,105C 'workspace-app':24B","nicknames":[],"mitigations":[],"who_affected":"Coder deployments running versions from 2.0.0 up to but not including 2.34.8 are affected. Exposure depends on workspace app subdomains being reachable by users who could be sent crafted links; deployments without workspace apps on subdomains are less exposed. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111931","severity":null,"published_at":"2026-10-17T19:16:36+00:00","modified_at":"2026-10-19T21:02:21+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}