---
id: "CVE-2026-111933"
kind: "vulnerability"
aliases: ["CVE-2026-111933"]
title: "Coder: login responses let attackers enumerate valid accounts"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["coder", "package", "self-hosted", "sso"]
not_affected_if: ["already-upgraded", "login-not-internet-exposed"]
published_at: "2026-10-17T19:16:36+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:01:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111933", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Coder: login responses let attackers enumerate valid accounts

Coder's password comparison uses a placeholder hash when a stored hash is empty, so a login attempt with the password "hunter2" returns HTTP 403 for existing accounts and 401 otherwise. An unauthenticated attacker can use this to confirm which accounts exist and learn which SSO provider SSO-only users rely on.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Coder server version with `coder version` and compare it against the fixed ranges below.
- Review whether SSO-only users exist on the deployment, since the sources say the provider is revealed for those accounts.

## Fix

- Upgrade Coder to `2.29.17`, `2.32.7`, `2.33.8`, or `2.34.2`, matching your release line.
- Until upgraded, restrict access to the login endpoint at the network or proxy layer where possible.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111933

## From the sources

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_