CVE-2026-111931Medium· 4.3▾ SunlitCoder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subd…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.
coder >= 2.0.0 < 2.34.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-58398Medium· 4.3Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
CVE-2025-71435Medium· 4.2Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
CVE-2026-111928Medium· 5.4Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
CVE-2026-111930Medium· 4.3Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
CVE-2026-111929Medium· 5.3Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
CVE-2026-111932Low· 3.4Coder before 2.34.2 Stored HTML Injection via Appearance Settings