{"id":"GO-2024-3228","revision":"4d0ae3092af445a48fd940ff9bf1dbfa","records":[{"revision":"4d0ae3092af445a48fd940ff9bf1dbfa","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2024-3228","aliases":["CVE-2024-58398","GHSA-wcx9-ccpj-hx3c"],"title":"Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder","description":"Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect') in github.com/coder/coder","state":0,"publishedAt":"2024-10-30T16:01:08+00:00","modifiedAt":"2026-10-18T10:55:48.0186104+00:00","affected":[{"ecosystem":"Go","name":"github.com/coder/coder","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.3.1"},{"kind":"fixed","version":"2.14.4"},{"kind":"introduced","version":"2.15.0"},{"kind":"fixed","version":"2.15.3"},{"kind":"introduced","version":"2.16.0"},{"kind":"fixed","version":"2.16.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c","https://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6"],"sourceUrl":"https://osv.dev/vulnerability/GO-2024-3228","license":"OSV · upstream source license applies","key":"osv:GO-2024-3228","identifiers":["GO-2024-3228","CVE-2024-58398","GHSA-wcx9-ccpj-hx3c"]},"retained":false,"historicalAffected":[]}],"coverage":[]}