# CVE-2024-58398: Coder open redirect in login page

Source: https://junglewise.ai/threats/cve-2024-58398-coder-2-3-1-before-2-14-4-2-15-x-before-2-15-3-and-2-16-0-before  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2024-58398 · Severity: medium · CVSS 4.3 · Published 2026-10-17

Coder is a remote development platform that allows teams to access cloud-based development environments. An open redirect vulnerability in the login page allows attackers to craft malicious URLs that redirect logged-in users to attacker-controlled websites for phishing attacks. While authentication tokens are not leaked, users can be tricked into entering credentials on fake login pages.

Technologies: [Coder](https://junglewise.ai/threats/technologies/coder). Vendors: [Coder](https://junglewise.ai/threats/vendors/coder).

## Quick answers

**Is CVE-2024-58398 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-58398 being exploited in the wild.

**How severe is CVE-2024-58398?** Medium severity, with a CVSS score of 4.3, published 17 October 2026.

**Which products and versions are affected?** Coder 2.3.1 before 2.14.4, 2.15.0 before 2.15.3, 2.16.0 before 2.16.1.

**Is there a fix for CVE-2024-58398?** Yes: fixed in Coder 2.14.4, 2.15.3, 2.16.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-58398 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2024-58398?** Check whether you run Coder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Coder 2.14.4, 2.15.3, 2.16.1

## Technical details

An open redirect vulnerability (CWE-601) exists in the login page's handling of the redirect query parameter, which is improperly sanitized. An unauthenticated attacker can craft a URL with an external redirect parameter that, when clicked by a logged-in user, redirects them outside the Coder application. The attack requires user interaction (clicking the malicious link) but no authentication or special privileges.

## Affected products

- Coder Coder 2.3.1 before 2.14.4, 2.15.0 before 2.15.3, 2.16.0 before 2.16.1

## Timeline

- 2024-10-28: advisory
- 2024-10-17: disclosed

## References

- [https://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6](https://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6)
- [https://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c](https://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c)

## Related threats

- [Coder AI Gateway encoded path traversal](https://junglewise.ai/threats/cve-2026-121967-coder-2-28-0-before-2-29-22-2-30-0-before-2-34-13-2-35-0-before)
- [Coder missing audience validation in GCP instance-identity endpoint](https://junglewise.ai/threats/cve-2026-118687-coder-before-2-29-21-2-30-0-before-2-34-12-2-35-0-before-2-35-9)
- [Coder open redirect in workspace app proxy](https://junglewise.ai/threats/cve-2026-111931-coder-from-2-0-0-before-2-34-8-contains-an-open-redirect)
- [Coder workspace ACL endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-111930-coder-from-2-26-0-before-2-34-8-contains-an-incorrect)
- [Coder provisioner daemon authorization bypass in DownloadFile](https://junglewise.ai/threats/cve-2026-111929-coder-from-2-30-0-before-2-34-8-contains-an-authorization-bypass)