User Enumeration Flaw in Coder Software by Coder Inc.
CVE-2026-111933

6.3MEDIUM

Key Information:

Vendor

Coder

Status
Coder
Vendor
CVE Published:
17 October 2026

What is CVE-2026-111933?

The Coder software prior to version 2.34.2 is susceptible to a user enumeration vulnerability. This flaw arises from the handling of empty password hashes, where a placeholder hash derived from 'hunter2' is utilized. Consequently, unauthenticated attackers can exploit this issue by submitting login attempts with the placeholder password. By distinguishing between HTTP responses of 403 and 401, attackers are able to ascertain valid username accounts and potentially identify the authentication providers utilized by single sign-on (SSO) users.

Affected Version(s)

coder 2.34.0 < 2.34.2

coder 2.33.0 < 2.33.8

coder 2.30.0 < 2.32.7

References

https://github.com/coder/coder/security/advisories/GHSA-8...
vendor-advisory
https://www.vulncheck.com/advisories/coder-before-2.34.2-...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.