{"id":"CVE-2026-111933","kind":"vulnerability","aliases":["CVE-2026-111933"],"related":[],"title":"Coder: login responses let attackers enumerate valid accounts","description":"Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.","summary":"Coder's password comparison uses a placeholder hash when a stored hash is empty, so a login attempt with the password \"hunter2\" returns HTTP 403 for existing accounts and 401 otherwise. An unauthenticated attacker can use this to confirm which accounts exist and learn which SSO provider SSO-only users rely on.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coder","package","self-hosted","sso"],"not_affected_if":["already-upgraded","login-not-internet-exposed"],"how_to_check":"- Check the Coder server version with `coder version` and compare it against the fixed ranges below.\n- Review whether SSO-only users exist on the deployment, since the sources say the provider is revealed for those accounts.","fix":"- Upgrade Coder to `2.29.17`, `2.32.7`, `2.33.8`, or `2.34.2`, matching your release line.\n- Until upgraded, restrict access to the login endpoint at the network or proxy layer where possible.","status":"open","published_at":"2026-10-17T19:16:36+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:01:51+00:00","updated_at":"2026-10-25T04:01:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:01:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Coder to `2.29.17`, `2.32.7`, `2.33.8`, or `2.34.2`, matching your release line.\n- Until upgraded, restrict access to the login endpoint at the network or proxy layer where possible.","reach":"internet","title":"Coder: login responses let attackers enumerate valid accounts","impact":"low","summary":"Coder's password comparison uses a placeholder hash when a stored hash is empty, so a login attempt with the password \"hunter2\" returns HTTP 403 for existing accounts and 401 otherwise. An unauthenticated attacker can use this to confirm which accounts exist and learn which SSO provider SSO-only users rely on.","category":"package","nicknames":[],"who_cares":["coder","self-hosted","sso"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker learns which accounts exist and their SSO provider","analyst_note":"","how_to_check":"- Check the Coder server version with `coder version` and compare it against the fixed ranges below.\n- Review whether SSO-only users exist on the deployment, since the sources say the provider is revealed for those accounts.","needs_analyst":false,"not_affected_if":["already-upgraded","login-not-internet-exposed"],"who_is_affected":"Coder deployments on the affected version ranges are exposed, and the login endpoint is reachable without an account. Instances that only accept logins from a private network or behind a VPN have a smaller exposure surface. The sources do not say whether managed or hosted Coder instances are patched by the vendor.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000633,"input_tokens":3425,"output_tokens":580,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111933':11A,14A '-2026':10A,13A '2.29.17':75C '2.30.0':76C '2.32.7':78C '2.33.0':79C '2.33.8':81C '2.34.0':83C '2.34.2':85C '401':50B,123C '403':45B,121C 'account':8A,48B,61B,128C 'attack':5A,54B,110C 'attempt':38B 'authent':132C 'coder':1A,15B,21B,73C 'comparison':24B 'confirm':59B 'contain':86C 'cve':9A,12A 'deriv':97C 'distinguish':119C 'empti':34B,108C 'enumer':6A,89C,126C 'exist':47B,62B 'hash':28B,32B,96C,106C 'host':19B 'http':44B,120C 'hunter2':42B,101C,117C 'learn':64B 'let':4A 'login':2A,37B,113C 'otherwis':51B 'packag':16B 'password':23B,41B,105C,116C 'placehold':27B,95C 'provid':67B,133C 'reli':72B 'respons':3A,124C 'return':43B 'reveal':130C 'self':18B 'self-host':17B 'sso':20B,66B,69B,136C 'sso-on':68B,135C 'store':31B,104C 'string':100C 'submit':112C 'substitut':93C 'unauthent':53B,109C 'use':25B,56B 'user':71B,88C,138C 'userpassword.compare':92C 'valid':7A,127C 'vulner':90C","nicknames":[],"mitigations":[],"who_affected":"Coder deployments on the affected version ranges are exposed, and the login endpoint is reachable without an account. Instances that only accept logins from a private network or behind a VPN have a smaller exposure surface. The sources do not say whether managed or hosted Coder instances are patched by the vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111933","severity":null,"published_at":"2026-10-17T19:16:36+00:00","modified_at":"2026-10-19T22:10:00+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}