{"id":"CVE-2024-58398","aliases":["EUVD-2024-55803","GHSA-7pxf-q642-mp95","GHSA-wcx9-ccpj-hx3c","GO-2024-3228"],"status":"published","title":"Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter","description":"Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00268,"percentile":0.19156,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2024-10-28T18:31:57Z","modified":"2026-11-09T10:10:00Z","fixes":[{"ecosystem":"Go","package":"github.com/coder/coder/v2","fixed_in":["2.16.1","2.15.3","2.14.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.0"},{"last_affected":"2.16.0"},{"fixed":"2.16.1"}]}],"versions":["2.16.0"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.0"},{"fixed":"2.15.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.1"},{"fixed":"2.14.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.16.0"},{"fixed":"2.16.1"}]}],"versions":["2.16.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.15.0"},{"fixed":"2.15.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.3.1"},{"fixed":"2.14.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coder/coder","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.3.1"},{"fixed":"2.14.4"},{"introduced":"2.15.0"},{"fixed":"2.15.3"},{"introduced":"2.16.0"},{"fixed":"2.16.1"}]}]}],"products":[{"vendor":"coder","product":"coder"}],"references":[{"url":"https://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c","tags":["vendor-advisory","advisory","web"]},{"url":"https://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6","tags":["patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/coder-2.3.1-before-2.16.1-open-redirect-via-login-page-redirect-parameter","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58398","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7pxf-q642-mp95"},{"url":"https://github.com/advisories/GHSA-wcx9-ccpj-hx3c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58398.json","tags":["advisory"]},{"url":"https://github.com/coder/coder","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-58398","title":"Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter","description":"Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.","status":"published","published":"2026-10-17T18:46:07.073Z","modified":"2026-10-21T21:34:59.156Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:34:08.843708Z"}],"euvd":[{"id":"EUVD-2024-55803","description":"Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.","status":"published","published":"2026-10-17T18:46:07Z","modified":"2026-10-21T21:34:59Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:35.88085Z"}],"ghsa":[{"id":"GHSA-7pxf-q642-mp95","title":"Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open...","description":"Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.","status":"published","published":"2026-10-17T21:31:16Z","modified":"2026-10-17T21:31:17Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:13:53.726362Z"},{"id":"GHSA-wcx9-ccpj-hx3c","title":"Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect')","description":"### Summary\nAn issue on Coder's login page allows attackers to craft a Coder URL that when clicked by a logged in user could redirect them to a website the attacker controls, e.g. https://google.com.\n\n### Details\nOn the login page, Coder checks for the presence of a `redirect` query parameter. On successful login, the user would be redirected to the location of the parameter. Improper sanitization allows attackers to specify a URL outside of the Coder application to redirect users to.\n\n### Impact\nCoder users could potentially be redirected to a untrusted website if tricked into clicking a URL crafted by the attacker. Coder authentication tokens are **not** leaked to the resulting website.\n\nTo check if your deployment is vulnerable, visit the following URL for your Coder deployment:\n- `https://\u003ccoder url\u003e/login?redirect=https%3A%2F%2Fcoder.com%2Fdocs`\n\n### Patched Versions\nThis vulnerability is remedied in\n- v2.16.1\n- v2.15.3\n- v2.14.4\n\nAll versions prior to 2.3.1 are not affected.\n\n### Thanks\n- https://github.com/jchristov\n\n### References\nhttps://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c\nhttps://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6","status":"published","published":"2024-10-28T18:31:57Z","modified":"2024-10-28T18:31:58Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:38:14.769863Z"}],"nvd":[{"id":"CVE-2024-58398","description":"Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.","status":"published","published":"2026-10-17T19:16:27.86Z","modified":"2026-11-09T10:10:00.217Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-09T12:13:56.102415Z"}],"osv":[{"id":"CVE-2024-58398","title":"Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter","description":"Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.","status":"published","published":"2026-10-17T18:46:07.073Z","modified":"2026-11-11T02:30:28.799756071Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-11T11:06:31.240748Z"},{"id":"GHSA-wcx9-ccpj-hx3c","title":"Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect')","description":"### Summary\nAn issue on Coder's login page allows attackers to craft a Coder URL that when clicked by a logged in user could redirect them to a website the attacker controls, e.g. https://google.com.\n\n### Details\nOn the login page, Coder checks for the presence of a `redirect` query parameter. On successful login, the user would be redirected to the location of the parameter. Improper sanitization allows attackers to specify a URL outside of the Coder application to redirect users to.\n\n### Impact\nCoder users could potentially be redirected to a untrusted website if tricked into clicking a URL crafted by the attacker. Coder authentication tokens are **not** leaked to the resulting website.\n\nTo check if your deployment is vulnerable, visit the following URL for your Coder deployment:\n- `https://\u003ccoder url\u003e/login?redirect=https%3A%2F%2Fcoder.com%2Fdocs`\n\n### Patched Versions\nThis vulnerability is remedied in\n- v2.16.1\n- v2.15.3\n- v2.14.4\n\nAll versions prior to 2.3.1 are not affected.\n\n### Thanks\n- https://github.com/jchristov\n\n### References\nhttps://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c\nhttps://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6","status":"published","published":"2024-10-28T18:31:57Z","modified":"2026-10-18T10:55:48.018610412Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"GO-2024-3228","title":"Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder","description":"Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder","status":"published","published":"2024-10-30T16:01:08Z","modified":"2026-10-18T10:55:48.018610412Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}