Ehaby

The web dashboard replaces the `$SESSION TOKEN` placeholder in external app URLs with a full-access API key without verifying if the app belongs to a sub-agent. This allows code running in a workspace to register a disguised sub-agent app using a custom protocol URL, which can lead to the owner's API key being sent to an attacker-controlled destination upon clicking.

Insufficient restrictions on the creation of new API keys allow a scoped API key or OAuth2 token with key-creation permissions to bypass scopes, allow lists, and expiry limits. By calling the 'POST /api/v2/users/{user}/keys/tokens' endpoint, an attacker can generate longer-lived keys with `coder:all` permissions, effectively gaining the full privileges of the user.