The AI Bridge Proxy component of Coder was incorrectly configured to skip TLS certificate verification when no upstream proxy was defined. This means that outbound HTTPS traffic to the Coder access URL would accept any certificate. An attacker who can position themselves on the network path between the Proxy and the Coder or reading payloads. The flaw is a classic TLS endpoint spoofing weakness (CWE‑295) that compromises confidentiality and integrity of data.

This vulnerability affects Coder versions 2.30.0 through 2.32.6, 2.33.0 through 2.33.7, and 2.34.0 through 2.34.1. The issue is fixed in releases 2.32.7, 2.33.8, and 2.34.2 and later.

The CVSS score of 7.4 classifies the issue as high‑severity. The EPSS score of <1% indicates a very low but nonzero probability of exploitation, and the vulnerability is not listed in the C, suggesting no publicly known active exploit. The primary vector requires an on‑path position between the AI Bridge Proxy and the Coder server. Mitigation is achieved by upgrading to the fixed releases or by ensuring that the Coder access URL presents a trusted certificate and that the communication path is isolated, e.g., via loopback or mutual TLS.