Open Redirect Vulnerability in Coder Login Page by Coder
CVE-2024-58398

5.3MEDIUM

Key Information:

Vendor

Coder

Status
Coder
Vendor
CVE Published:
17 October 2026

What is CVE-2024-58398?

The Coder application versions 2.3.1 through 2.16.0 are susceptible to an open redirect issue on their login page due to improper sanitization of the redirect query parameter. This flaw allows attackers to create malicious login URLs that can trick logged-in users into being redirected to potentially harmful, attacker-controlled websites, facilitating phishing attempts. It is crucial for users of affected versions to apply relevant patches and secure their applications against these threats.

Affected Version(s)

coder 2.16.0 < 2.16.1

coder 2.15.0 < 2.15.3

coder 2.3.1 < 2.14.4

References

https://github.com/coder/coder/security/advisories/GHSA-w...
vendor-advisory
https://github.com/coder/coder/commit/69c1d981e3131e50d52...
patch
https://www.vulncheck.com/advisories/coder-2.3.1-before-2...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

jchristov
.