CVE-2026-111931 in Coder
Summary
by MITRE • 10/17/2026
Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The identified security flaw resides within the Coder application, specifically affecting versions ranging from 2.0.0 up to but not including version 2.34.8. This vulnerability is classified as an open redirect issue located in the handleAPIKeySmuggling function. The root cause of this weakness stems from improper validation and sanitization of user-supplied input, particularly regarding the r.URL.Path variable. In web application architecture, URL path components are frequently used to determine routing or redirection targets. When these values are not rigorously checked against a whitelist of allowed domains or patterns before being processed by redirect logic, they can be manipulated by malicious actors to point toward external, untrusted destinations.
The technical mechanism exploited here relies on the behavior of scheme-relative URLs in web browsers and HTTP clients. By crafting links that begin with double slashes followed by a domain name, such as //evil.com/path, an attacker creates a reference that inherits the protocol (HTTP or HTTPS) from the current page but redirects to the specified external host. Because Coder operates within workspace app subdomains which are often considered trusted contexts by users and potentially some security filters, attackers can embed these malicious links in phishing campaigns. When a user clicks such a link while authenticated with their API keys, they may be redirected away from the legitimate application interface without any warning indicators that would typically appear if navigating to an entirely different top-level domain via standard absolute URLs.
The operational impact of this vulnerability is primarily centered around social engineering and credential theft through phishing attacks. Since the redirect originates from a trusted subdomain associated with Coder, victims are more likely to trust the link initially. Once redirected to the attacker-controlled site, users may be presented with a convincing replica of the login page or an API key generation interface designed to harvest sensitive authentication tokens. The successful exploitation allows attackers to capture valid API keys, which can then be used for unauthorized access to cloud resources, data exfiltration, or further lateral movement within the victim's infrastructure. This undermines the integrity and confidentiality guarantees provided by the application’s authentication mechanisms.
From a classification perspective, this vulnerability aligns with CWE-601, Open Redirect URL Redirection, which describes flaws where an attacker can redirect users to malicious sites due to insufficient validation of input parameters used in redirection logic. In terms of offensive security tactics, this technique is consistent with the ATT&CK framework’s T1583.002, Acquire Infrastructure: Domains, and potentially T1566.001, Phishing: Spearphishing Link, as it leverages trusted infrastructure to facilitate credential harvesting. The lack of strict domain validation in the redirect handler represents a critical oversight in secure coding practices for web applications handling sensitive authentication workflows.
To mitigate this vulnerability, immediate patching is required by upgrading Coder to version 2.34.8 or later, where the handleAPIKeySmuggling function has been corrected to properly sanitize and validate URL paths before processing redirects. In environments where an upgrade cannot be implemented immediately, network-level controls such as Web Application Firewalls can be configured to detect and block requests containing scheme-relative redirect patterns like double slashes followed by external domains in query parameters or path segments associated with authentication flows. Additionally, implementing strict Content Security Policy headers that restrict frame ancestors and navigation targets can help mitigate the impact of successful phishing attempts derived from this flaw. Developers should also adopt a principle of least privilege for API key generation endpoints and ensure all user-controlled inputs used in redirection logic are validated against an allowlist of known safe domains rather than relying on negative filtering or simple string checks that may be bypassed by scheme-relative syntax.