| Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh tokenCVE-2025-71435 · GHSA-3RW9-WMC8-8948Version ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
Low
|
Fix reported |
|
| Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect')CVE-2024-58398 · GHSA-WCX9-CCPJ-HX3CVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
Medium
|
Fix reported |
|
| Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settingsCVE-2026-111932 · GHSA-H58C-XCCX-75M3Version ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
Low
|
Fix reported |
|
| Coder: Login endpoint user enumeration via timing-defense placeholder in password comparisonCVE-2026-111933 · GHSA-8FXQ-53RX-PH5FVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
Low
|
Fix reported |
|
| Coder's workspace agent API insecure redirect handling allowed cross-agent file read and writeCVE-2026-63443 · GHSA-QRWJ-VH9X-GW5VVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
High
|
Fix reported |
|
| Coder's OIDC authentication allows email with partially matching domain to registerCVE-2024-27918 · GHSA-7CC2-R658-7XPFVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
High
|
Fix reported |
|
| Suspended Coder users retain access to AI Bridge LLM proxy endpointsCVE-2026-55435 · GHSA-WQXV-W64V-5WH6Version ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
Medium
|
Fix reported |
|
| Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpointsCVE-2026-55434 · GHSA-F5VP-W269-392GVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
Medium
|
Fix reported |
|
| Coder vulnerable to workspace auto-creation via crafted URL parameters without user consentCVE-2026-44454 · GHSA-M3CR-VC2J-PM27Version ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
High
|
Fix reported |
|
| Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace appsCVE-2026-55431 · GHSA-V54H-CP2W-9X4GVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
High
|
Fix reported |
|
| Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofingCVE-2026-55438 · GHSA-5WG6-JMQ2-53PWVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
Medium
|
Fix reported |
|
| Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine componentCVE-2026-55437 · GHSA-7QW2-F75V-62F7Version ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
Medium
|
Fix reported |
|
| Coder's AI Bridge Proxy skips TLS certificate verification in default configurationCVE-2026-55436 · GHSA-84RM-42XW-MX52Version ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
High
|
Fix reported |
|
| Coder: Zip upload decompression lacks aggregate size limit, enabling denial of serviceCVE-2026-55078 · GHSA-2MG2-P7R7-G27FVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
Medium
|
Fix reported |
|
| Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data accessCVE-2026-55430 · GHSA-5G4W-3VW9-478WVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
Medium
|
Fix reported |
|
| Coder's sub-agent app registration bypasses template port-sharing policy enforcementCVE-2026-55432 · GHSA-X9QQ-2QH5-8RXFVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
Medium
|
Fix reported |
|
| Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containersCVE-2026-55433 · GHSA-JQJ2-X4C5-JFXMVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
Medium
|
Fix reported |
|
| Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app IDCVE-2026-55429 · GHSA-9RJW-3GWP-F59VVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
High
|
Fix reported |
|
| Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinatorCVE-2026-55428 · GHSA-WRQ8-FCV5-8HVPVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
High
|
Fix reported |
|
| Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypassCVE-2026-55075 · GHSA-9R87-MVCW-X35FVersion ranges need review. |
github.com/coder/coder/v2github.com/coder/coder |
Go |
High
|
Fix reported |
|
