Product by Go
Github.com/coder/coder
9 known vulnerabilities in Github.com/coder/coder (Go), 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-44454 | Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent | 8.1 | |
| High | CVE-2026-63443 | Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write | 8.3 | |
| High | CVE-2024-27918 | Coder's OIDC authentication allows email with partially matching domain to register | 8.2 | |
| Critical | CVE-2026-46354 | Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft | 9.1 | |
| Medium | CVE-2026-45796 | Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint | 6.5 | |
| Medium | CVE-2026-111933 | Coder before 2.34.2 User Enumeration via Login Placeholder Hash | 3.7 | |
| Medium | CVE-2024-58398 | Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter | 4.3 | |
| Medium | CVE-2026-111932 | Coder before 2.34.2 Stored HTML Injection via Appearance Settings | 3.4 | |
| Medium | CVE-2025-71435 | Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token | 4.2 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 27sans-atrisk-mail,