CVE-2026-111933Low· 3.7▾ SunlitCoder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a s…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.
coder >= 2.34.0 < 2.34.2coder >= 2.33.0 < 2.33.8coder >= 2.30.0 < 2.32.7coder < 2.29.17Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/coder/coder/v2 >= 2.34.0, < 2.34.2github.com/coder/coder/v2 >= 2.33.0, < 2.33.8github.com/coder/coder/v2 >= 2.30.0, < 2.32.7github.com/coder/coder/v2 < 2.29.17Patched in:
github.com/coder/coder/v2 2.34.2github.com/coder/coder/v2 2.33.8github.com/coder/coder/v2 2.32.7github.com/coder/coder/v2 2.29.17Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111932Low· 3.4Coder before 2.34.2 Stored HTML Injection via Appearance Settings
GHSA-8fxq-53rx-ph5fLow· 3.7Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison
GO-2026-6267NoneCoder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder
GO-2026-6265NoneCoder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder
CVE-2024-58398Medium· 4.3Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
CVE-2025-71435Medium· 4.2Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token