CVE-2026-111933

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

EUVD-2026-103300

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

CVE-2026-111933

The Coder software versions prior to 2.34.2 (specifically before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2) are vulnerable to a user enumeration flaw. The root cause is that the userpassword.Compare() function substitutes a placeholder hash derived from the str...

CVE-2026-111933 Coder before 2.34.2 User Enumeration via Login Placeholder Hash

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

CVE-2026-111933 Coder before 2.34.2 User Enumeration via Login Placeholder Hash

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

CVE-2026-111933 Coder before 2.34.2 User Enumeration via Login Placeholder Hash

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

CVE-2026-111933

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

CVE-2026-111933: Observable Discrepancy

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

PT-2026-116501

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can...

Coder side-channel information leakage vulnerability

Versions of Coder prior to 2.29.17, 2.32.7, 2.30.0 prior to 2.33.0, 2.33.0 prior to 2.33.8, and 2.34.0 prior to 2.34.2 have a side-channel information leakage vulnerability. This vulnerability stems from the use of a placeholder hash derived from the string “hunter2” by the userpassword.Compare...

PT-2026-83649

Summary userpassword.Compare substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash nonexistent users and SSO-only users and a subsequent login-type check returned an HTTP 40...