Live › vulnerability › CVE-2026-111933
Go to dashboardCoder's password comparison uses a placeholder hash when a stored hash is empty, so a login attempt with the password "hunter2" returns HTTP 403 for existing accounts and 401 otherwise. An unauthenticated attacker can use this to confirm which accounts exist and learn which SSO provider SSO-only users rely on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Coder deployments on the affected version ranges are exposed, and the login endpoint is reachable without an account. Instances that only accept logins from a private network or behind a VPN have a smaller exposure surface. The sources do not say whether managed or hosted Coder instances are patched by the vendor.
No product ranges from the sources yet.
coder version and compare it against the fixed ranges below.2.29.17, 2.32.7, 2.33.8, or 2.34.2, matching your release line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.
This page as .md · .json · in your agent: get_signal("CVE-2026-111933")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.