{"id":"CVE-2024-58398","kind":"vulnerability","aliases":["CVE-2024-58398"],"related":[],"title":"Coder: login page open redirect lets attackers send users to phishing sites","description":"Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.","summary":"Coder's login page does not properly check the redirect parameter, so a crafted login link sends a logged-in user to any site the attacker chooses. The main risk is phishing: the victim lands on a fake page after a trusted Coder URL.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coder","package","self-hosted","web-login"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed Coder version with `coder version`\n- Compare the result against the fixed releases listed in the fix field\n- unknown whether the sources describe a config check","fix":"- Upgrade Coder to `2.14.4` or later on the 2.14 line, `2.15.3` or later on the 2.15 line, or `2.16.1` or later on the 2.16 line\n- unknown whether a configuration workaround exists","status":"open","published_at":"2026-10-17T19:16:27+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:26:54+00:00","updated_at":"2026-10-25T04:26:54+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:26:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Coder to `2.14.4` or later on the 2.14 line, `2.15.3` or later on the 2.15 line, or `2.16.1` or later on the 2.16 line\n- unknown whether a configuration workaround exists","reach":"internet","title":"Coder: login page open redirect lets attackers send users to phishing sites","impact":"low","summary":"Coder's login page does not properly check the redirect parameter, so a crafted login link sends a logged-in user to any site the attacker chooses. The main risk is phishing: the victim lands on a fake page after a trusted Coder URL.","category":"package","nicknames":[],"who_cares":["coder","self-hosted","web-login"],"confidence":0.8,"needs_auth":"no","worst_case":"Victim is redirected to attacker site for phishing credentials","analyst_note":"","how_to_check":"- Check the installed Coder version with `coder version`\n- Compare the result against the fixed releases listed in the fix field\n- unknown whether the sources describe a config check","needs_analyst":false,"not_affected_if":["patched-version"],"who_is_affected":"Teams that self-host Coder in the affected version ranges are exposed, because any user who clicks a crafted login link can be redirected. Instances on the fixed versions or later are not affected. The sources do not say whether managed or hosted Coder deployments are patched by the vendor.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000594,"input_tokens":3373,"output_tokens":514,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2024':14A,17A '-58398':15A,18A '2.14.4':75C '2.15':76C '2.15.3':79C '2.16.0':81C '2.16.1':83C '2.3.1':73C 'attack':7A,53B,101C,123C 'attacker-control':122C 'check':34B 'choos':54B 'click':110C 'coder':1A,19B,27B,70B,72C,105C 'contain':84C 'control':124C 'craft':40B,103C 'cve':13A,16A 'fake':65B 'host':23B 'improp':99C 'land':62B 'let':6A 'link':42B 'log':46B,114C 'logged-in':45B,113C 'login':2A,26B,29B,41B,91C,106C 'main':56B 'open':4A,86C 'packag':20B 'page':3A,30B,66B,92C 'paramet':37B,97C 'phish':11A,59B,127C 'proper':33B 'queri':96C 'redirect':5A,36B,87C,95C,117C 'risk':57B 'sanit':100C 'self':22B 'self-host':21B 'send':8A,43B 'site':12A,51B 'trust':69B 'url':71B,107C 'user':9A,48B,116C 'victim':61B,119C 'vulner':88C 'web':25B 'web-login':24B 'websit':125C 'x':77C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Coder in the affected version ranges are exposed, because any user who clicks a crafted login link can be redirected. Instances on the fixed versions or later are not affected. The sources do not say whether managed or hosted Coder deployments are patched by the vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-58398","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58398","severity":null,"published_at":"2026-10-17T19:16:27+00:00","modified_at":"2026-10-21T22:16:46+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}