The vulnerability allows an attacker to manipulate the X-Forwarded-Host HTTP header in client-side JavaScript, causing the workspace app proxy to resolve the target application based on this header without stripping or validating it. A malicious user can steer the proxy to route traffic to an arbitrary subdomain of the same deployment. This behavior can cause a user on one tenant’s application to read or modify data that belongs to another tenant, compromising confidentiality and potentially integrity. The weakness is represented by missing input validation (CWE‑345) and inappropriate access control (CWE‑441).

The product affected is Coder by Coder. Versions earlier than 2.29.7, 2.32.7, 2.33.8, and 2.34.2 are vulnerable. Deployments using any of these vulnerable versions with subdomain app routing enabled are at risk.

The CVSS score of 5.8 reflects a moderate severity. The EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Practical exploitation requires three conditions: subdomain app routing must be enabled; a victim must visit an attacker‑controlled shared application; and the upstream proxy in the chain must not strip the X-Forwarded-Host header. The attack vector is remote and occurs via a malicious client‑side script that sets the header, without needing local privileges. Once executed the attacker can read or modify cross‑tenant data within the same deployment.