# CVE-2023-26114: Coder code-server missing origin validation in WebSocket

Source: https://junglewise.ai/threats/cve-2023-26114-coder-code-server-missing-origin-validation-in-websocket  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-03-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-26114 · Severity: low · CVSS 3.1 · Published 2023-03-23

code-server is a cloud-based development environment that allows developers to write and edit code through a web browser. A missing origin validation flaw in its WebSocket implementation could allow an attacker to hijack a user's code-server session from a malicious website, potentially exposing sensitive code, credentials, and project data. The vulnerability affects users with older browsers that lack modern cookie protections or those accessing code-server on shared domains.

Technologies: [code-server (npm)](https://junglewise.ai/threats/technologies/code-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2023-26114 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-26114 being exploited in the wild.

**How severe is CVE-2023-26114?** Low severity, with a CVSS score of 3.1, published 23 March 2023.

**Which products and versions are affected?** code-server (npm) SEMVER:introduced=0,fixed=4.10.1.

**Is there a fix for CVE-2023-26114?** Yes. code-server (npm): upgrade to 4.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-26114 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2023-26114?** Check whether you run code-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code-server (npm): upgrade to 4.10.1 or later

  ```sh
  npm install code-server@4.10.1
  ```


## Technical details

The vulnerability is a missing origin validation (CWE-1385, CWE-346) in code-server's WebSocket handshake implementation affecting versions before 4.10.1. An attacker can perform a cross-site WebSocket hijacking (CSWSH) attack by crafting a malicious webpage that establishes a WebSocket connection to a victim's code-server instance when the victim visits the attacker's site. The attack requires user interaction (visiting a malicious site) and is more exploitable in environments using older browsers without SameSite cookie support or shared domain deployments. The fix, deployed in version 4.10.1, adds origin header validation to reject WebSocket connections from unauthorized origins.

## Affected products

- Coder code-server before 4.10.1

## Identifiers

- CVE-2023-26114
- GHSA-frjg-g767-7363

## Timeline

- 2023-03-23: disclosed: GitHub Security Advisory GHSA-frjg-g767-7363 published
- 2023-03-03: patched: Fix merged in commit d477972c68fc8c8e8d610aa7287db87ba90e55c7
- 2023-03-23: advisory: CVE-2023-26114 assigned

## References

- [https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7](https://github.com/coder/code-server/commit/d477972c68fc8c8e8d610aa7287db87ba90e55c7)

## Related threats

- [code-server session cookie extraction via malicious proxy URL](https://junglewise.ai/threats/cve-2025-47269-code-server-session-cookie-extraction-via-malicious-proxy-url)
- [Coder code-server XSS in error page](https://junglewise.ai/threats/cve-2021-42648-coder-code-server-xss-in-error-page)
- [code-server regular expression denial of service](https://junglewise.ai/threats/cve-2021-3810-code-server-regular-expression-denial-of-service)