CVE-2026-111933CWE-203

CVE-2026-111933

Low · published October 17, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00225 · 12.5th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2026-10-17T23:16Z
References (2)
https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f · [email protected]https://www.vulncheck.com/advisories/coder-before-2.34.2-user-enumeration-via-login-placeholder-hash · [email protected]
EPSS history
Timeline
  • 19 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 17 OCT 18:46Z
    Coder before 2.34.2 User Enumeration via Login Placeholder Hash
    cvelistv5
  • 17 OCT 18:46Z
    Coder before 2.34.2 User Enumeration via Login Placeholder Hash
    cvelistv5