Improper Hostname Validation Enables API Key Compromise

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.

Casky was already ahead

This CVE exploits attack patterns that Casky's 233matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Coder versions before 2.29.20, 2.33.12, 2.34.8, and 2.35.4 suffer from a critical hostname validation flaw in the GetWorkspaceProxyByHostname function. The vulnerability stems from a flawed SIMILAR TO pattern that performs only prefix matching on domain names, allowing attackers who control any domain that is a string prefix of a workspace-proxy access URL to be trusted as legitimate proxies. This affects authenticated users of Coder who can be socially engineered to visit a crafted /api/v2/applications/auth-redirect link. Once clicked, the attacker can intercept the redirected application_connect API key and replay it to gain unauthorized access to workspace resources. Organizations running vulnerable Coder instances face potential lateral movement, data exfiltration, and persistent access threats through compromised API credentials.

Casky's 233 matched skills leverage Claude's extended reasoning to detect the attack chains underlying this vulnerability within MITRE ATT&CK tactic TA0006 (Credential Access). Practitioners using Casky would identify detection signals across multiple techniques: T1598 (Phishing) for the initial social engineering of the crafted link, T1056 (Input Capture) for credential interception during the auth-redirect flow, and T1111 (Multi-Factor Authentication Interception) where API keys bypass traditional MFA. The platform would correlate suspicious hostname resolution patterns, domain prefix anomalies in proxy configurations, and unusual auth-redirect requests originating from non-standard domains. Security teams would receive findings highlighting API key replay attempts, mismatched hostname validation logs, and authentication events from unexpected domain origins—enabling rapid detection of exploitation attempts before attackers establish persistence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

233 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-111927.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0006

Investigate the attack patterns behind CVE-2026-111927

Casky has 233 skills that investigate the attack patterns behind CVE-2026-111927. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn