Coder CVE-2026-111927

Exploitation requires all of the following: the attacker must own or control a domain whose name is a string prefix of a legitimate Coder workspace-proxy access URL (the specific flaw in the SIMILAR TO pattern in GetWorkspaceProxyByHostname); a workspace-proxy must be configured in the target deployment so that a proxy access URL exists to be prefix-matched; and an already-authenticated Coder victim must click a crafted /api/v2/applications/auth-redirect link (UI:P). These limit exploitation to targeted scenarios: it fails against deployments with no workspace proxy, against unauthenticated or non-interacting users, and where the attacker cannot acquire a suitably prefix-shaped domain. Affected versions are Coder before 2.29.20, 2.33.0-2.33.11, 2.34.0-2.34.7, and 2.35.0-2.35.3.

This is a credible, above-average priority for any organization running Coder, but not an emergency. The provided CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P, score 8.7) is driven high by HIGH confidentiality and integrity impact plus a scope change (SC:H/SI:H) reflecting that a stolen application_connect key grants access to the victim's workspace apps. Several signals temper the raw score: attack complexity is High (AC:H) with an attack requirement (AT:P) - the attacker must already own a domain that is a string prefix of a legitimate workspace-proxy access URL - and successful exploitation requires luring an already-authenticated victim into clicking a crafted link (PR:L + UI:P). No EPSS score was provided, the CVE is not in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The combination of required victim interaction, the need to control a specifically-shaped domain, and authenticated-victim preconditions makes this far better suited to targeted phishing of a known Coder deployment than to opportunistic mass exploitation - consistent with the High CVSS being a per-victim severity measure rather than a widespread-exploitation predictor.

An attacker who registers or controls a domain that is a string prefix of an organization's Coder workspace-proxy access URL sends a targeted phishing message to an authenticated Coder user containing a crafted /api/v2/applications/auth-redirect link. When the victim clicks, the flawed SIMILAR TO prefix match in GetWorkspaceProxyByHostname trusts the attacker domain as a legitimate proxy and the victim's browser forwards the application_connect API key to the attacker, who replays it to access the victim's workspace applications. No public exploit is identified at time of analysis, and the attack depends on victim interaction (UI:P) and attacker control of a suitably-named domain (AC:H).