CVE-2026-111933

Coder before 2.34.2 User Enumeration via Login Placeholder Hash

State: Published
Severity: 6.3 Medium
Published: Oct 17, 2026
Updated: Oct 19, 2026
Reserved: Oct 17, 2026

Description

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-203 Observable Discrepancy

Affected Products

Product	Versions
codercoder	2.34.0 to before 2.34.2Affected 2.34.2Not affected
codercoder	2.33.0 to before 2.33.8Affected 2.33.8Not affected
codercoder	2.30.0 to before 2.32.7Affected 2.32.7Not affected
codercoder	before 2.29.17Affected 2.29.17Not affected

References

GitHub Security Advisory (GHSA-8fxq-53rx-ph5f)vendor-advisory
VulnCheck Advisory: Coder before 2.34.2 User Enumeration via Login Placeholder Hashthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.