Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because… (CVE-2026-111933)

The vulnerability in Coder affects multiple version ranges prior to 2.29.17, 2.32.7, 2.33.8, and 2.34.2 respectively. It arises from the userpassword.Compare() function substituting a fixed placeholder hash based on the string "hunter2" when no stored password hash exists. This behavior allows unauthenticated attackers to submit login attempts with the password "hunter2" and differentiate HTTP 403 Forbidden responses from HTTP 401 Unauthorized responses. This difference enables attackers to enumerate valid user accounts and identify the authentication provider used by SSO-only users. The issue is classified under CWE-203 (Information Exposure Through Discrepancy).

The vulnerability allows unauthenticated attackers to enumerate valid user accounts by distinguishing HTTP response codes during login attempts. This information disclosure can aid attackers in further targeted attacks or reconnaissance. The authentication provider of SSO-only users can also be revealed. The CVSS score of 3.7 reflects a low to medium impact primarily related to information disclosure without direct compromise of confidentiality, integrity, or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor for updates from the vendor and avoid exposing login endpoints unnecessarily. Do not rely on this mechanism for user enumeration protection. Implement additional rate limiting or anomaly detection to mitigate enumeration attempts if possible.