Technical impact
Coder’s subdomain‑based workspace app proxy contains a flaw that lets an attacker bypass the same‑owner CORS check when the workspace‑name segment of the subdomain is parsed as a UUID. The proxy then resolves the workspace by that UUID without confirming that the host’s username matches the real owner, and the CORS middleware accepts the unvalidated username in the hostname. This results in the attacker being able to issue arbitrary HTTP requests from the victim’s authenticated session. The weakness is a classic example of CWE‑346, where untrusted data is trusted in a critical security decision.
Affected Systems
The issue is present in the Coder platform (vendor coder) in any deployment running a pre‑patch release: versions older than 2.29.17, 2.32.7, 2.33.8, and 2.34.2. Victims must have subdomain app routing (wildcard hostname) enabled and be authenticated while visiting a crafted URL in order for the vulnerability to be exploitable.
Risk and Exploitability
The CVSS score of 5.8 places the vulnerability in the moderate range, and the EPSS score of less than 1% indicates a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that a user visits a malicious URL making it a user‑dependent attack but one that can lead to data exfiltration or unauthorized actions if successful.
Github GHSA