Live › vulnerability › CVE-2024-58398
Go to dashboardCoder's login page does not properly check the redirect parameter, so a crafted login link sends a logged-in user to any site the attacker chooses. The main risk is phishing: the victim lands on a fake page after a trusted Coder URL.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host Coder in the affected version ranges are exposed, because any user who clicks a crafted login link can be redirected. Instances on the fixed versions or later are not affected. The sources do not say whether managed or hosted Coder deployments are patched by the vendor.
No product ranges from the sources yet.
coder version2.14.4 or later on the 2.14 line, 2.15.3 or later on the 2.15 line, or 2.16.1 or later on the 2.16 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.
This page as .md · .json · in your agent: get_signal("CVE-2024-58398")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.