CVE-2026-118687

A flaw was found in Coder. The application fails to properly validate the audience claim in Google Compute Engine GCE instance-identity JSON Web Tokens JWT during workspace agent authentication. A remote attacker who obtains an unexpired token issued for another service can replay it to obtain a...