CVE-2026-111933 Coder before 2.34.2 User Enumeration via Login Placeholder Hash

Medium 6.3 Published 17 Oct 2026 Updated 19 Oct 2026

Unauthenticated attackers can enumerate valid user accounts and identify SSO-only users by exploiting a placeholder hash comparison flaw in the login mechanism.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-111933?

CVE-2026-111933 is a medium-severity vulnerability in coder, published on 17 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.

Weakness: CWE-203

Which versions are affected by CVE-2026-111933?

10 open source packages ship an affected version, including github.com/coder/coder/v2 and github.com/coder/coder.

Package	Affected	Fixed in
`github.com/coder/coder/v2` Go	All versions	`2.29.17, 2.32.7, 2.33.8, 2.34.2`
`github.com/coder/coder/v2` Go	All versions	`2.29.17`
`github.com/coder/coder/v2` Go	All versions	`2.29.17`
`github.com/coder/coder/v2` Go	From `2.30.0`	`2.32.7`
`github.com/coder/coder/v2` Go	From `2.30.0`	`2.32.7`
`github.com/coder/coder/v2` Go	From `2.33.0`	`2.33.8`

4 more packages

`github.com/coder/coder/v2` Go	From `2.33.0`	`2.33.8`
`github.com/coder/coder/v2` Go	From `2.34.0`	`2.34.2`
`github.com/coder/coder/v2` Go	From `2.34.0`	`2.34.2`
`github.com/coder/coder` Go	All versions	None

How do I fix CVE-2026-111933?

Upgrade github.com/coder/coder/v2 to a fixed version for your release line: 2.29.17, 2.32.7, 2.33.8 or 2.34.2.

Is CVE-2026-111933 being exploited?

There is no known exploitation of CVE-2026-111933 in the wild and no public exploit code.

Sources

Also known as GHSA-8fxq-53rx-ph5f, GHSA-wwfw-5crg-94f6, GO-2026-6265.