{"cve":"CVE-2024-58398","nvd":{"published":"2026-10-17T19:16:27.860","modified":"2026-10-21T22:16:46.353","status":"Awaiting Analysis","description":"Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","score":4.3},"cwes":["CWE-601"],"references":["https://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6","https://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c","https://www.vulncheck.com/advisories/coder-2.3.1-before-2.16.1-open-redirect-via-login-page-redirect-parameter"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2024-58398","score":0.00268,"percentile":0.18813,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-wcx9-ccpj-hx3c","url":"https://osv.dev/vulnerability/GHSA-wcx9-ccpj-hx3c","summary":"Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect')","modified":"2026-10-18T10:55:48.018610412Z","packages":[{"ecosystem":"Go","name":"github.com/coder/coder/v2","purl":"pkg:golang/github.com/coder/coder/v2","ranges":[">=2.16.0 <2.16.1"],"fixed":["2.16.1"]},{"ecosystem":"Go","name":"github.com/coder/coder/v2","purl":"pkg:golang/github.com/coder/coder/v2","ranges":[">=2.15.0 <2.15.3"],"fixed":["2.15.3"]},{"ecosystem":"Go","name":"github.com/coder/coder/v2","purl":"pkg:golang/github.com/coder/coder/v2","ranges":[">=2.3.1 <2.14.4"],"fixed":["2.14.4"]}]},{"id":"GO-2024-3228","url":"https://osv.dev/vulnerability/GO-2024-3228","summary":"Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder","modified":"2026-10-18T10:55:48.018610412Z","packages":[{"ecosystem":"Go","name":"github.com/coder/coder","purl":"pkg:golang/github.com/coder/coder","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/coder/coder/v2","purl":"pkg:golang/github.com/coder/coder/v2","ranges":[">=2.3.1 <2.14.4",">=2.15.0 <2.15.3",">=2.16.0 <2.16.1"],"fixed":["2.14.4","2.15.3","2.16.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}