CVE-2026-111933: Coder before 2.34.2 User Enumeration via Login Placeholder Hash
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are Coder before 2.29.17, versions 2.30.0 through before 2.32.7, versions 2.33.0 through before 2.33.8, and versions 2.34.0 through before 2.34.2.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They must submit login attempts using the password "hunter2" and distinguish HTTP 403 responses from HTTP 401 responses.
What information can be exposed?
The issue allows enumeration of valid user accounts. It can also reveal the authentication provider for users that use SSO only.
How can I tell whether exploitation attempts may be occurring?
Review login request logs for unauthenticated attempts using the password "hunter2" and compare resulting HTTP 401 and 403 responses. Such response differences can be used to identify valid accounts or SSO-only users.