{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "coder: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/coder--coder/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/coder--coder/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111927/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111927/",
   "title": "CVE-2026-111927 disclosed",
   "content_text": "Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.",
   "date_published": "2026-10-17T18:46:39Z"
  }
 ]
}