{"id":"CVE-2026-111933","aliases":["EUVD-2026-103300","GHSA-8fxq-53rx-ph5f","GHSA-wwfw-5crg-94f6","GO-2026-6265"],"status":"published","title":"Coder before 2.34.2 User Enumeration via Login Placeholder Hash","description":"Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00225,"percentile":0.13353,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203","CWE-204"],"published":"2026-08-20T18:34:21Z","modified":"2026-10-28T02:31:03Z","fixes":[{"ecosystem":"Go","package":"github.com/coder/coder/v2","fixed_in":["2.34.2","2.33.8","2.32.7","2.29.17"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.34.0"},{"fixed":"2.34.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.33.0"},{"fixed":"2.33.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.30.0"},{"fixed":"2.32.7"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.29.17"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.34.0"},{"fixed":"2.34.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.33.0"},{"fixed":"2.33.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.30.0"},{"fixed":"2.32.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.29.17"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coder/coder","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.29.17"},{"introduced":"2.30.0"},{"fixed":"2.32.7"},{"introduced":"2.33.0"},{"fixed":"2.33.8"},{"introduced":"2.34.0"},{"fixed":"2.34.2"}]}]}],"products":[{"vendor":"coder","product":"coder"}],"references":[{"url":"https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f","tags":["vendor-advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/coder-before-2.34.2-user-enumeration-via-login-placeholder-hash","tags":["third-party-advisory","advisory"]},{"url":"https://github.com/coder/coder/pull/26205","tags":["web","fix"]},{"url":"https://github.com/coder/coder/commit/35a7dc8ab9c7f15ce05d963947823ee31224512f","tags":["web","fix"]},{"url":"https://github.com/coder/coder/releases/tag/v2.29.17","tags":["web"]},{"url":"https://github.com/coder/coder/releases/tag/v2.32.7","tags":["web"]},{"url":"https://github.com/coder/coder/releases/tag/v2.33.8","tags":["web"]},{"url":"https://github.com/coder/coder/releases/tag/v2.34.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8fxq-53rx-ph5f"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111933","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wwfw-5crg-94f6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111933.json","tags":["advisory"]},{"url":"https://github.com/coder/coder","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-111933","title":"Coder before 2.34.2 User Enumeration via Login Placeholder Hash","description":"Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.","status":"published","published":"2026-10-17T18:46:43.456Z","modified":"2026-10-19T15:12:57.23Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:20:15.34316Z"}],"euvd":[{"id":"EUVD-2026-103300","description":"Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.","status":"published","published":"2026-10-17T18:46:43Z","modified":"2026-10-19T15:12:57Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:51.186399Z"}],"ghsa":[{"id":"GHSA-8fxq-53rx-ph5f","title":"Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison","description":"### Summary\n\n`userpassword.Compare()` substituted a placeholder hash derived from the well-known string `\"hunter2\"` when the stored hash was empty. Submitting `\"hunter2\"` therefore matched accounts with no password hash (nonexistent users and SSO-only users) and a subsequent login-type check returned an HTTP 403 that disclosed the account's login type, versus 401 for password users.\n\n\u003e **Note:** Practical exploitation is limited because the timing side channel is noisy and only reveals whether an account exists.\n\n### Impact\n\nAn unauthenticated attacker could enumerate valid accounts and their authentication provider by submitting logins with the password `\"hunter2\"`, distinguishing nonexistent users, SSO users (provider revealed) and password users from the response. This aids credential-stuffing and targeted phishing. No authentication bypass or data access resulted.\n\n### Patches\n\nThe fix derives the timing-defense placeholder from a secure random value that no supplied password can match.\n\nThe fix was backported to all supported release lines:\n\n| Release line | Patched version |\n|---|---|\n| 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) |\n| 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) |\n| 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) |\n| 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) |\n\n### Workarounds\n\nNone.\n\n### References\n\n- Fix: #26205\n\n### Credits\n\nWe'd like to thank Anthropic's Security Team (ANT-2026-22433) for independently disclosing this issue!","status":"published","published":"2026-08-20T18:34:21Z","modified":"2026-08-20T18:34:23Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-203","CWE-204"],"updated_at":"2026-11-02T14:41:03.602876Z"},{"id":"GHSA-wwfw-5crg-94f6","title":"Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2...","description":"Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.","status":"published","published":"2026-10-17T21:31:20Z","modified":"2026-10-17T21:31:26Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T15:13:53.726362Z"}],"nvd":[{"id":"CVE-2026-111933","description":"Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.","status":"published","published":"2026-10-17T19:16:36.36Z","modified":"2026-10-24T19:10:00.127Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:13:00.123071Z"}],"osv":[{"id":"CVE-2026-111933","title":"Coder before 2.34.2 User Enumeration via Login Placeholder Hash","description":"Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.","status":"published","published":"2026-10-17T18:46:43.456Z","modified":"2026-10-28T02:31:03.772122411Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T15:44:55.938017Z"},{"id":"GHSA-8fxq-53rx-ph5f","title":"Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison","description":"### Summary\n\n`userpassword.Compare()` substituted a placeholder hash derived from the well-known string `\"hunter2\"` when the stored hash was empty. Submitting `\"hunter2\"` therefore matched accounts with no password hash (nonexistent users and SSO-only users) and a subsequent login-type check returned an HTTP 403 that disclosed the account's login type, versus 401 for password users.\n\n\u003e **Note:** Practical exploitation is limited because the timing side channel is noisy and only reveals whether an account exists.\n\n### Impact\n\nAn unauthenticated attacker could enumerate valid accounts and their authentication provider by submitting logins with the password `\"hunter2\"`, distinguishing nonexistent users, SSO users (provider revealed) and password users from the response. This aids credential-stuffing and targeted phishing. No authentication bypass or data access resulted.\n\n### Patches\n\nThe fix derives the timing-defense placeholder from a secure random value that no supplied password can match.\n\nThe fix was backported to all supported release lines:\n\n| Release line | Patched version |\n|---|---|\n| 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) |\n| 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) |\n| 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) |\n| 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) |\n\n### Workarounds\n\nNone.\n\n### References\n\n- Fix: #26205\n\n### Credits\n\nWe'd like to thank Anthropic's Security Team (ANT-2026-22433) for independently disclosing this issue!","status":"published","published":"2026-08-20T18:34:21Z","modified":"2026-10-18T10:55:40.994398805Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-203","CWE-204"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"GO-2026-6265","title":"Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder","description":"Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder","status":"published","published":"2026-08-25T19:43:10Z","modified":"2026-10-18T10:55:40.994398805Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}