Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the… (CVE-2024-58398)

An open redirect vulnerability exists in Coder login pages for versions 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1. The issue arises from improper sanitization of the redirect query parameter, which can be exploited by attackers to redirect authenticated users to attacker-controlled sites, potentially facilitating phishing attacks. The vulnerability is identified as CWE-601 and has a CVSS 3.1 score of 4.3, indicating medium severity. No known exploits are reported in the wild, and no vendor advisory or patch links were provided in the input data.

The vulnerability allows attackers to redirect logged-in users to malicious websites via crafted login URLs. This can be used for phishing attacks, potentially leading to credential theft or other social engineering impacts. There is no direct impact on confidentiality or availability reported, and no known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Coder advisories for updates and apply patches once available. Until then, caution should be exercised when clicking on login URLs from untrusted sources.