What’s Vulnerable › Vulnerabilities

CVE-2024-58398: Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-17 · updated 2026-10-21
• Weakness: CWE-601

Description

Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.

Affected products

• coder: from 2.16.0 before 2.16.1; from 2.15.0 before 2.15.3; from 2.3.1 before 2.14.4 — fixed in 2.14.4, 2.15.3, 2.16.1

How to fix

Upgrade to a fixed version: coder 2.14.4, 2.15.3, 2.16.1. Check the vendor advisory for mitigations.

References

• https://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6
• https://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c
• https://www.vulncheck.com/advisories/coder-2.3.1-before-2.16.1-open-redirect-via-login-page-redirect-parameter

Get alerted when CVE-2024-58398 or the next vulnerability affects your stack