Coder (< 2.29.20, >= 2.33.0 < 2.33.12, >= 2.34.0 < 2.34.8, >= 2.35.0 < 2.35.4)

Coder versions prior to 2.29.20, 2.33.12, 2.34.8, and 2.35.4 are vulnerable to an improper hostname validation flaw, allowing attackers to intercept workspace API keys via crafted redirect links.