CVE-2024-58398

4.3 MEDIUMpublic exploit available

Published 2026-10-17 · Updated 2026-10-17

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses

CWE-601

Public exploit & PoC references

https://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6
https://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c

All references

https://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6
https://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c
https://www.vulncheck.com/advisories/coder-2.3.1-before-2.16.1-open-redirect-via-login-page-redirect-parameter

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2024-58389PoC
MEDIUMCVE-2026-100523PoC
CRITICALCVE-2026-101090PoC
MEDIUMCVE-2026-101151
HIGHCVE-2026-101152
UNSCOREDCVE-2026-101907PoC
MEDIUMCVE-2026-102090PoC
UNSCOREDCVE-2026-102778

Related by shared AI tags and CWE weakness class. Browse the full archive.