---
id: "CVE-2026-111931"
kind: "vulnerability"
aliases: ["CVE-2026-111931"]
title: "Coder: open redirect in API key handling sends users to attacker sites"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["coder", "infrastructure", "self-hosted", "workspace-apps"]
not_affected_if: ["coder-2.34.8-or-later"]
published_at: "2026-10-17T19:16:36+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:26:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111931", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Coder: open redirect in API key handling sends users to attacker sites

Coder versions from 2.0.0 before 2.34.8 do not sanitize the URL path in handleAPIKeySmuggling, so a crafted link on a trusted workspace app subdomain can redirect a user to an external site. An attacker gets a trusted-looking link for phishing, not code execution or direct data access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Coder version with `coder version` and compare it against `2.34.8`.
- Confirm whether the deployment serves workspace apps on subdomains, since the redirect is reached through those subdomains.

## Fix

- Upgrade Coder to `2.34.8` or later.
- unknown for interim mitigations.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111931

## From the sources

Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_