Coder CVE-2026-111931

Exploitation requires the target Coder deployment (2.0.0 through 2.34.7) to serve workspace apps on trusted subdomains, and the attacker must induce a user to click a crafted link whose URL path begins with double slashes so that handleAPIKeySmuggling emits it as a scheme-relative redirect. Key limiting factors: it is an open redirect only (no code execution, data read, or session theft directly), success depends on victim user interaction (UI:P) and social engineering, and the payload must be hosted on/through a legitimate workspace app subdomain of the target instance rather than an arbitrary host. No authentication is required of the attacker (PR:N), but the practical impact is confined to phishing/redirection.

This is a genuinely medium/low-priority issue despite being network-reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) and the 5.3 base score correctly capture an open redirect (CWE-601): reachable over the network without authentication but requiring the victim to interact with (click) an attacker-crafted link, with only limited integrity impact (VI:L) and no confidentiality or availability impact (VC:N/VA:N) and no subsequent-system impact (SC:N/SI:N/SA:N). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The signals are internally consistent - this is a classic phishing-enabler, not a system-compromise bug: its real value to an attacker is lending legitimacy to phishing by abusing a trusted workspace-app subdomain, so impact depends entirely on a user being socially engineered. Verify affected-version range against the GitHub Security Advisory (GHSA-98qx-9p2x-c4wh), as that is the only patch-level source referenced.

An attacker registers or identifies a victim organization's Coder deployment and crafts a URL on a trusted workspace app subdomain whose path begins with double slashes (e.g. //evil.example). When a user clicks the link, the unsanitized r.URL.Path is treated as a scheme-relative redirect and the browser is sent to the attacker-controlled site, which mimics the Coder login or workspace UI to harvest credentials. No public exploit code was identified, but open redirects are trivial to reproduce from the description, and success requires the victim to click (UI:P).