Coder contains an improper hostname validation flaw that performs a prefix match against workspace‑proxy URLs. Attackers owning a domain that is a string prefix of a workspace‑proxy access URL can therefore be treated as a trusted proxy. An authenticated victim who follows a crafted /api/v2/applications/auth‑redirect link will have the victim’s application_connect API key captured and can replay it to access the victim’s workspace applications. The vulnerability is a classic example of insecure credential storage and handling (CWE‑522).

The flaw exists in Coder prior to 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4. All affected releases are offered by the Coder vendor.

The CVSS score of 8.7 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires an attacker to own a matching domain and lure an authenticated user, but once executed it grants the attacker arbitrary access to the victim’s workspace via the stolen API key.