Cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*

Coder versions prior to 2.29.20, 2.33.12, 2.34.8, and 2.35.4 are vulnerable to an improper hostname validation flaw, allowing attackers to intercept workspace API keys via crafted redirect links.