Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in… (CVE-2026-111927)

This vulnerability (CVE-2026-111927) affects multiple versions of Coder prior to specific fixed releases. The root cause is improper hostname validation in the GetWorkspaceProxyByHostname function, which uses a SIMILAR TO pattern that matches prefixes rather than exact hostnames. Consequently, an attacker owning a domain that is a prefix of a legitimate workspace-proxy URL can exploit this by luring authenticated users to a specially crafted authentication redirect link. This enables the attacker to capture the redirected application_connect API key and reuse it to gain unauthorized access to the victim's workspace applications. The CVSS 3.1 base score is 7.7 (High), reflecting network attack vector, high impact on confidentiality and integrity, but requiring low privileges and user interaction.

Successful exploitation allows an attacker to impersonate a trusted proxy by exploiting hostname validation flaws, capture sensitive API keys from authenticated users, and gain unauthorized access to workspace applications. This compromises confidentiality and integrity of the victim's workspace environment. Availability is not impacted. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official vendor channels for updates and apply patches once available. Until then, avoid interacting with untrusted domains that could be prefix matches of workspace-proxy URLs and be cautious with authentication redirect links.