DNS Rebinding Vulnerability in AgentAPI by Coder

CVE-2025-59956

What is CVE-2025-59956?

AgentAPI, an HTTP API for multiple coding tools such as Claude Code and Aider, is vulnerable to a client-side DNS rebinding attack when running over unprotected HTTP on localhost. This vulnerability enables attackers to exploit the /messages endpoint of the API, potentially leading to unauthorized access to sensitive information, including local message history, secret keys, and intellectual property. The security flaw is addressed in version 0.4.0 of AgentAPI, emphasizing the importance of keeping software up to date to mitigate such risks.

References