{"id":"CVE-2026-111927","title":"Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match","summary":"Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-522"],"vendor":"coder","product":"coder","affected":["coder >= 2.35.0 < 2.35.4","coder >= 2.34.0 < 2.34.8","coder >= 2.33.0 < 2.33.12","coder < 2.29.20"],"published":"2026-10-17","updated":"2026-10-17","sourceUpdated":"2026-10-17T18:46:39.347Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111927","references":[{"url":"https://github.com/coder/coder/security/advisories/GHSA-h58h-qvv5-xvwg","label":"GitHub Security Advisory (GHSA-h58h-qvv5-xvwg)"},{"url":"https://www.vulncheck.com/advisories/coder-before-2.35.4-credential-theft-via-workspace-proxy-hostname-prefix-match","label":"VulnCheck Advisory: Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match"}],"tags":["cve.org"],"ingestedAt":"2026-10-17T19:08:56.476Z","slug":"CVE-2026-111927","body":"## Overview\n\nCoder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.\n\n## Affected\n\n- `coder >= 2.35.0 < 2.35.4`\n- `coder >= 2.34.0 < 2.34.8`\n- `coder >= 2.33.0 < 2.33.12`\n- `coder < 2.29.20`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}