CVE-2026-111931

Publié : 17 octobre 2026

Modifié : 17 octobre 2026

Score CVSS

4.3

MEDIUM

Description détaillée

Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Références et Patchs

https://github.com/coder/coder/security/advisories/GHSA-98qx-9p2x-c4wh https://www.vulncheck.com/advisories/coder-2.0.0-before-2.34.8-open-redirect-via-workspace-app-proxy

Dernières Vulnérabilités

CVE-2026-108117

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-107772

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-107345

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS