CVE-2026-55438: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing

Coder’s subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the workspace was resolved by ID without confirming the URL’s username matched the real owner, while the CORS middleware trusted the unverified username in the hostname.

Note: Practical exploitation requires subdomain app routing (wildcard hostname) enabled and a victim who visits the attacker’s crafted app URL while authenticated.