CVE-2026-111933

EUVD-2026-103300

17.10.2026, 19:16

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
VulnCheck	CNA	3.7 LOW	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 12.48%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
coder	coder	2.34.0 ≤ 𝑥 < 2.34.2	CNA
coder	coder	2.33.0 ≤ 𝑥 < 2.33.8	CNA
coder	coder	2.30.0 ≤ 𝑥 < 2.32.7	CNA
coder	coder	𝑥 < 2.29.17	CNA

Common Weakness Enumeration

CWE-203 - Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References

https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f

https://www.vulncheck.com/advisories/coder-before-2.34.2-user-enumeration-via-login-placeholder-hash