What’s Vulnerable › Vulnerabilities

CVE-2026-111933: Coder before 2.34.2 User Enumeration via Login Placeholder Hash

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-17 · updated 2026-10-24
• Weakness: CWE-203

Description

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.

Affected products

• coder: from 2.34.0 before 2.34.2; from 2.33.0 before 2.33.8; from 2.30.0 before 2.32.7; before 2.29.17 — fixed in 2.29.17, 2.32.7, 2.33.8, 2.34.2

How to fix

Upgrade to a fixed version: coder 2.29.17, 2.32.7, 2.33.8, 2.34.2. Check the vendor advisory for mitigations.

References

• https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f
• https://www.vulncheck.com/advisories/coder-before-2.34.2-user-enumeration-via-login-placeholder-hash

Get alerted when CVE-2026-111933 or the next vulnerability affects your stack