The Coder 2.x authentication page allows a crafted URL with an unsanitized redirect query parameter to send a logged-in user to an attacker‑controlled site. This open redirect flaw can be employed for phishing or drive‑by download attacks. The vulnerability is classified as CWE‑601 and specifically undermines the integrity of navigation after authentication.

Versions of the Coder application from 2.3.1 up to but not including 2.14.4, from 2.15.x up to but not including 2.15.3, and from 2.16.0 up to but not including 2.16.1 are affected. Any installation exposing the login URL with a redirect parameter is vulnerable. The product is provided by Coder, Inc.

The CVSS score of 5.3 indicates moderate severity. Because the EPSS score is not available, the current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must find a victim who is already authenticated to click the malicious URL. The risk is therefore limited to scenarios where phishing links are circulated among logged‑in users, but the attack is straightforward once a suitable URL is crafted.