Threats tagged 'ghsa-j9wc-wg7r-6rm3'

Coder versions before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 do not validate the audience claim of Google Cloud Engine (GCE) instance-identity JWTs at a specific API endpoint. This flaw allows attackers who obtain a valid identity token intended for another relying party to replay it and gain unauthorized access to a workspace agent's session token, which remains valid until the next workspace build. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.