Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect')

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

5.1 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N · score source

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary An issue on Coder's login page allows attackers to craft a Coder URL that when clicked by a logged in user could redirect them to a website the attacker controls, e.g. https://google.com. Details On the login page, Coder checks for the presence of a redirect query parameter. On successful login, the user would be redirected to the location of the parameter. Improper sanitization allows attackers to specify a URL outside of the Coder application to redirect users to. Impact Coder users could potentially be redirected to a untrusted website if tricked into clicking a URL crafted by the attacker. Coder authentication tokens are not leaked to the resulting website. To check if your deployment is vulnerable, visit the following URL for your Coder deployment: - https://<coder url/login?redirect=https%3A%2F%2Fcoder.com%2Fdocs Patched Versions This vulnerability is remedied in - v2.16.1 - v2.15.3 - v2.14.4 All versions prior to 2.3.1 are not affected. Thanks -…

Published by the source

28 Oct 2024, 18:31 UTC

Last modified by the source

28 Oct 2024, 18:31 UTC

Source last checked

26 Oct 2026, 15:05 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-wcx9-ccpj-hx3c

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-wcx9-ccpj-hx3c

Advisory: Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect')
IDs: GHSA-wcx9-ccpj-hx3c
Record: https://patchnext.com/advisories/ghsa-wcx9-ccpj-hx3c (revision 1, source checked 26 Oct 2026, 15:05 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/coder/coder/v2 2.16.1, 2.15.3, 2.14.4. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/coder/coder/v2: affected >= 2.16.0, <= 2.16.0; >= 2.15.0, < 2.15.3; >= 2.3.1, < 2.14.4; fixed in 2.15.3, 2.16.1, 2.14.4

## Suggested inspection (read-only)
- Go github.com/coder/coder/v2: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/coder/coder/v2.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-wcx9-ccpj-hx3c (GitHub-reviewed advisory GHSA-wcx9-ccpj-hx3c lists affected ranges: Go github.com/coder/coder/v2 >=2.16.0 =2.15.0 =2.3.1 <2.14.4)

Commands are suggestions: review each one before running it.