CVE-2026-111933
Full vulnerability record from the local CVENow database.
Description
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.
Severity
MEDIUM
CVSS score
6.3
(v4.0)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-10-17 19:16:36.360000
Last modified
2026-10-24 19:10:00.127000
View original CVE JSON
{
"id": "CVE-2026-111933",
"sourceIdentifier": "[email protected]",
"published": "2026-10-17T19:16:36.360",
"lastModified": "2026-10-24T19:10:00.127",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users."
},
{
"lang": "es",
"value": "Coder versiones anteriores a 2.29.17, versiones 2.30.0 hasta la versión 2.32.7 excluida, versiones 2.33.0 hasta la versión 2.33.8 excluida y versiones 2.34.0 hasta la versión 2.34.2 excluida contiene una vulnerabilidad de enumeración de usuarios porque userpassword.Compare() sustituye un hash de marcador de posición derivado de la cadena \\“hunter2\\” cuando el hash de la contraseña almacenada está vacío. Los atacantes no autenticados pueden enviar inicios de sesión con la contraseña \\“hunter2\\” y distinguir respuestas HTTP 403 de 401 para enumerar cuentas válidas y revelar el proveedor de autenticación de los usuarios exclusivamente SSO."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.34.0",
"lessThan": "2.34.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.34.2",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.33.0",
"lessThan": "2.33.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.33.8",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.30.0",
"lessThan": "2.32.7",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.32.7",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "0",
"lessThan": "2.29.17",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.29.17",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 3.7,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-19T15:09:55.562810Z",
"id": "CVE-2026-111933",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-203"
}
]
}
],
"references": [
{
"url": "https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/coder-before-2.34.2-user-enumeration-via-login-placeholder-hash",
"source": "[email protected]"
}
]
}