CVE-2026-55431: Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSION_TOKEN placeholder the CLI replaces it with the user’s real session token before handing the URL to the OS open handler.

Note: Practical exploitation requires the victim to run coder open app against a workspace whose external app definition the attacker controls. Only a malicious template author can control external app URLs.