Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sat, 17 Oct 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users. | |
| Title | Coder before 2.34.2 User Enumeration via Login Placeholder Hash | |
| First Time appeared |
Coder
Coder coder |
|
| Weaknesses | CWE-203 | |
| CPEs | cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Coder
Coder coder |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-17T18:46:43.456Z
Reserved: 2026-10-17T12:20:52.372Z
Link: CVE-2026-111933
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-17T19:16:36.360
Modified: 2026-10-17T19:16:36.360
Link: CVE-2026-111933
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses