CVE-2026-111927

The Coder software versions before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 are vulnerable to a credential theft flaw. The root cause is an improper hostname validation in GetWorkspaceProxyByHostname, where a SIMILAR TO pattern performs a prefix match . This ...

EUVD-2026-103294

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927 Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927 Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111926 Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2026-111926

The Coder software versions 2.10.0 through 2.34.8 are vulnerable to an information disclosure flaw. An unauthenticated agent debug HTTP server listening on 127.0.0.1:2113 contains a /debug/manifest handler that returns the full agent manifest. This manifest includes sensitive template-provided en...

EUVD-2026-103293

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2026-111926 Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2026-111926 Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2026-111926

Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this...

CVE-2025-71435 Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

CVE-2024-58398 Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter

Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to a...

CVE-2024-58398

The software Coder versions 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 is vulnerable to an open redirect vulnerability. The root cause is the improper sanitization of the redirect query parameter on the login page. An attacker can craft a malicious login URL that, when cl...

CVE-2025-71435

Versions of Coder prior to 2.23.0 are vulnerable to a session expiration bypass when using OIDC without a refresh token. Authenticated users can maintain access after their OIDC token expires by keeping their APIKey cookie active through regular use, which extends the session indefinitely every 2...

EUVD-2025-211113

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

EUVD-2024-55803

Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to a...

CVE-2025-71435 Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...

CVE-2024-58398 Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter

Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to a...

CVE-2025-71435 Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely...