Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent (CVE-2026-44454) | HOL Guard CVE