GHSA-8fxq-53rx-ph5f: Low severity go/github.com/coder/coder/v2 vulnerability
Summary
userpassword.Compare() substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash (nonexistent users and SSO-only users) and a subsequent login-type check returned an HTTP 403 that disclosed the account's login type, versus 401 for password users.
Note: Practical exploitation is limited because the timing side channel is noisy and only reveals whether an account exists.
Impact
An unauthenticated attacker could enumerate valid accounts and their authentication provider by submitting logins with the password "hunter2", distinguishing nonexistent users, SSO users (provider revealed) and password users from the response. This aids credential-stuffing and targeted phishing. No authentication bypass or data access resulted.
Patches
The fix derives the timing-defense placeholder from a secure random value that no supplied password can match.
The fix was backported to all supported release lines:
| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |
Workarounds
None.
References
- Fix: #26205
Credits
We'd like to thank Anthropic's Security Team (ANT-2026-22433) for independently disclosing this issue!
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.34.2 - Upgrade
Upgrade
coder/coderto a version that resolves this vulnerability.Fixed in v2.29.17 - Upgrade
Upgrade
coder/coderto a version that resolves this vulnerability.Fixed in v2.32.7 - Upgrade
Upgrade
coder/coderto a version that resolves this vulnerability.Fixed in v2.33.8 - Upgrade
Upgrade
coder/coderto a version that resolves this vulnerability.Fixed in v2.34.2
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker does not need authentication or user interaction. They can submit login attempts using the password "hunter2" and compare the HTTP response to distinguish nonexistent users, password users, and SSO-only users; for SSO users, the authentication provider may also be disclosed.
What is the practical impact of successful exploitation?
The issue enables account existence and authentication-provider enumeration, which can support credential-stuffing and targeted phishing. It does not provide an authentication bypass or access to account data, and exploitation is limited by a noisy timing side channel.
Which patched releases are identified?
The fix is available in v2.34.2 for the 2.34 release line and v2.33.8 for the 2.33 release line. The advisory states that the fix was backported to all supported release lines.
How can administrators assess whether their deployment is exposed?
Test login behavior for a nonexistent account, a password-based account, and an SSO-only account using the password "hunter2". Vulnerable behavior distinguishes these cases through responses, including HTTP 403 after the login-type check for matching empty hashes versus HTTP 401 for password users.