Improper Input Validation

🗓️ 10 Jul 2026 08:14:24Reported by Veracode Vulnerability DatabaseType

Coder suffers improper input validation of web address scheme and host, risking session token exposure.

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2026-55431	8 Jul 202600:10	–	attackerkb
Tenable Nessus	Coder < 2.29.17 / 2.30.x < 2.32.7 / 2.33.x < 2.33.8 / 2.34.x < 2.34.2 Multiple Vulnerabilities	10 Jul 202600:00	–	nessus
CVE	CVE-2026-55431	8 Jul 202600:10	–	cve
Cvelist	CVE-2026-55431 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps	8 Jul 202600:10	–	cvelist
EUVD	EUVD-2026-42140	8 Jul 202600:10	–	euvd
Github Security Blog	Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps	6 Jul 202621:07	–	github
NVD	CVE-2026-55431	8 Jul 202601:16	–	nvd
OSV	CVE-2026-55431 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps	8 Jul 202600:10	–	osv
OSV	GHSA-V54H-CP2W-9X4G Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps	6 Jul 202621:07	–	osv
OSV	GO-2026-5924 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder	7 Jul 202616:41	–	osv

Vulners

Node

Source	Link
github	www.github.com/coder/coder/commit/d7774e5c4ca222ee89a8b6aa82b61c1f8bb81d1f
github	www.github.com/coder/coder/commit/91d18653f940168c30ac1dc198864834aa08616d
github	www.github.com/advisories/GHSA-v54h-cp2w-9x4g
github	www.github.com/coder/coder/releases/tag/v2.32.7
github	www.github.com/coder/coder/security/advisories/GHSA-v54h-cp2w-9x4g
github	www.github.com/coder/coder/pull/26146
github	www.github.com/coder/coder/releases/tag/v2.29.17
github	www.github.com/coder/coder/releases/tag/v2.34.2
github	www.github.com/coder/coder/releases/tag/v2.33.8

11 Jul 2026 16:33Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.1 - 7.7

EPSS0.00336

SSVC