---
id: CVE-2026-111933
title: Coder before 2.34.2 User Enumeration via Login Placeholder Hash
summary: >-
  Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0
  before 2.34.2 contains a user enumeration vulnerability because
  userpassword.Compare() substitutes a placeholder hash derived from the string
  "hunter2" when a s…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-203
vendor: coder
product: coder
affected:
  - coder >= 2.34.0 < 2.34.2
  - coder >= 2.33.0 < 2.33.8
  - coder >= 2.30.0 < 2.32.7
  - coder < 2.29.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-19T15:09:55.562810Z'
published: '2026-10-17'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T15:12:57.230Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111933'
references:
  - url: 'https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f'
    label: GitHub Security Advisory (GHSA-8fxq-53rx-ph5f)
  - url: >-
      https://www.vulncheck.com/advisories/coder-before-2.34.2-user-enumeration-via-login-placeholder-hash
    label: >-
      VulnCheck Advisory: Coder before 2.34.2 User Enumeration via Login
      Placeholder Hash
  - url: 'https://github.com/coder/coder/pull/26205'
  - url: >-
      https://github.com/coder/coder/commit/35a7dc8ab9c7f15ce05d963947823ee31224512f
  - url: 'https://github.com/coder/coder'
  - url: 'https://github.com/coder/coder/releases/tag/v2.29.17'
  - url: 'https://github.com/coder/coder/releases/tag/v2.32.7'
  - url: 'https://github.com/coder/coder/releases/tag/v2.33.8'
  - url: 'https://github.com/coder/coder/releases/tag/v2.34.2'
tags:
  - cve.org
  - osv
  - go
epss: 0.00225
epssPercentile: 0.13138
aliases:
  - GHSA-8fxq-53rx-ph5f
  - GO-2026-6265
ecosystem: go
patched:
  - github.com/coder/coder/v2 2.34.2
  - github.com/coder/coder/v2 2.33.8
  - github.com/coder/coder/v2 2.32.7
  - github.com/coder/coder/v2 2.29.17
ingestedAt: '2026-10-17T19:08:56.530Z'
---

## Overview

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.

## Affected

- `coder >= 2.34.0 < 2.34.2`
- `coder >= 2.33.0 < 2.33.8`
- `coder >= 2.30.0 < 2.32.7`
- `coder < 2.29.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-111933)

Affected packages:

- `github.com/coder/coder/v2 >= 2.34.0, < 2.34.2`
- `github.com/coder/coder/v2 >= 2.33.0, < 2.33.8`
- `github.com/coder/coder/v2 >= 2.30.0, < 2.32.7`
- `github.com/coder/coder/v2 < 2.29.17`

Patched in:

- `github.com/coder/coder/v2 2.34.2`
- `github.com/coder/coder/v2 2.33.8`
- `github.com/coder/coder/v2 2.32.7`
- `github.com/coder/coder/v2 2.29.17`

Source: https://osv.dev/vulnerability/GHSA-8fxq-53rx-ph5f