The vulnerability allows an attacker to construct URLs that exploit an unvalidated path field in the handleAPIKeySmuggling endpoint. Links that start with double slashes become scheme‑relative redirects to attacker‑controlled domains, permitting phishing attacks while appearing to originate from a trusted workspace subdomain.

Vendors affected are those using Coder’s "coder" platform. All releases from version 2.0.0 through but not including 2.34.8 are vulnerable. Upgrade to version 2.34.8 or later to eliminate the issue.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited documented exploitation. Attackers can weaponise crafted links in marketing emails or internal communications to direct users to malicious sites, exploiting the trust placed in workspace subdomains.