CVE-2026-111933

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f
https://www.vulncheck.com/advisories/coder-before-2.34.2-user-enumeration-via-login-placeholder-hash

Configurations

No configuration.

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Coder versiones anteriores a 2.29.17, versiones 2.30.0 hasta la versión 2.32.7 excluida, versiones 2.33.0 hasta la versión 2.33.8 excluida y versiones 2.34.0 hasta la versión 2.34.2 excluida contiene una vulnerabilidad de enumeración de usuarios porque userpassword.Compare() sustituye un hash de marcador de posición derivado de la cadena \“hunter2\” cuando el hash de la contraseña almacenada está vacío. Los atacantes no autenticados pueden enviar inicios de sesión con la contraseña \“hunter2\” y distinguir respuestas HTTP 403 de 401 para enumerar cuentas válidas y revelar el proveedor de autenticación de los usuarios exclusivamente SSO.

17 Oct 2026, 19:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-17 19:16

Updated : 2026-10-24 19:10

NVD link : CVE-2026-111933

Mitre link : CVE-2026-111933

CVE.ORG link : CVE-2026-111933

JSON object : View

Products Affected

No product.

CWE

CWE-203

Observable Discrepancy

{"id": "CVE-2026-111933", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111933", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-19T15:09:55.562810Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.34.0", "lessThan": "2.34.2", "versionType": "semver"}, {"status": "unaffected", "version": "2.34.2", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.33.0", "lessThan": "2.33.8", "versionType": "semver"}, {"status": "unaffected", "version": "2.33.8", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.30.0", "lessThan": "2.32.7", "versionType": "semver"}, {"status": "unaffected", "version": "2.32.7", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "0", "lessThan": "2.29.17", "versionType": "semver"}, {"status": "unaffected", "version": "2.29.17", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}]}], "published": "2026-10-17T19:16:36.360", "references": [{"url": "https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/coder-before-2.34.2-user-enumeration-via-login-placeholder-hash", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-203"}]}], "descriptions": [{"lang": "en", "value": "Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users."}, {"lang": "es", "value": "Coder versiones anteriores a 2.29.17, versiones 2.30.0 hasta la versi\u00f3n 2.32.7 excluida, versiones 2.33.0 hasta la versi\u00f3n 2.33.8 excluida y versiones 2.34.0 hasta la versi\u00f3n 2.34.2 excluida contiene una vulnerabilidad de enumeraci\u00f3n de usuarios porque userpassword.Compare() sustituye un hash de marcador de posici\u00f3n derivado de la cadena \\\u201chunter2\\\u201d cuando el hash de la contrase\u00f1a almacenada est\u00e1 vac\u00edo. Los atacantes no autenticados pueden enviar inicios de sesi\u00f3n con la contrase\u00f1a \\\u201chunter2\\\u201d y distinguir respuestas HTTP 403 de 401 para enumerar cuentas v\u00e1lidas y revelar el proveedor de autenticaci\u00f3n de los usuarios exclusivamente SSO."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "disclosure@vulncheck.com"}