Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally… (CVE-2026-111931)

The vulnerability identified as CVE-2026-111931 affects Coder software versions starting from 2.0.0 and prior to 2.34.8. It is an open redirect issue located in the handleAPIKeySmuggling function, where unsanitized r.URL.Path values permit attackers to create URLs that redirect users externally. Specifically, URLs with paths beginning with double slashes are interpreted as scheme-relative redirects, enabling attackers to redirect users from trusted workspace app subdomains to attacker-controlled domains. This behavior can facilitate phishing attacks by exploiting user trust in the original domain.

The vulnerability does not impact confidentiality or availability but can lead to limited integrity impact by enabling phishing attacks through user redirection to malicious sites. There is no indication of active exploitation in the wild. The CVSS score is 4.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, user interaction required, and limited impact on integrity only.

A fix is available in Coder version 2.34.8 and later. Users should upgrade to version 2.34.8 or newer to remediate this open redirect vulnerability. Until patched, users should exercise caution with URLs containing double slashes in paths on trusted workspace app subdomains. No vendor advisory was provided, so verify the patch status with official Coder release notes or security advisories.