GHSA-5g4w-3vw9-478w: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

Coder's workspace app routing trusts an unauthenticated HTTP header called X-Forwarded-Host (a header that tells the server what hostname the request came for) without verifying it came from a trusted source. An attacker can set this header in their browser to trick the server into routing requests to a victim's private app while still using the victim's authentication cookies (session identifiers), allowing the attacker to read data from that private app. This only works if subdomain app routing (using wildcard hostnames to serve multiple apps) is enabled and the upstream proxy doesn't remove this header.