---
id: "CVE-2024-58398"
kind: "vulnerability"
aliases: ["CVE-2024-58398"]
title: "Coder: login page open redirect lets attackers send users to phishing sites"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["coder", "package", "self-hosted", "web-login"]
not_affected_if: ["patched-version"]
published_at: "2026-10-17T19:16:27+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:26:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58398", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Coder: login page open redirect lets attackers send users to phishing sites

Coder's login page does not properly check the redirect parameter, so a crafted login link sends a logged-in user to any site the attacker chooses. The main risk is phishing: the victim lands on a fake page after a trusted Coder URL.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Coder version with `coder version`
- Compare the result against the fixed releases listed in the fix field
- unknown whether the sources describe a config check

## Fix

- Upgrade Coder to `2.14.4` or later on the 2.14 line, `2.15.3` or later on the 2.15 line, or `2.16.1` or later on the 2.16 line
- unknown whether a configuration workaround exists

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-58398

## From the sources

Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_