Authentication Bypass via User Enumeration in Coder

Executive Summary

CVE-2026-111933 is a user enumeration vulnerability in Coder versions before 2.34.2, 2.33.8, 2.32.7, and 2.29.17. The system uses a placeholder hash derived from 'hunter2' when a stored password hash is empty. Attackers can submit 'hunter2' as a password and observe HTTP responses to determine valid accounts and authentication providers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP responses from your Coder login endpoint. Send login attempts with the password 'hunter2' and check if responses differ between HTTP 403 (valid account) and 401 (invalid account). Automate this with tools like curl or Burp Suite to test multiple usernames.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to enumerate valid user accounts and identify SSO-only users. It could aid credential-stuffing or phishing attacks by revealing which accounts exist and their authentication methods. The impact is limited by timing side channels but still poses a security risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability enables attackers to enumerate valid user accounts and determine authentication methods, which could lead to unauthorized access or data breaches. Such breaches may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, potentially resulting in non-compliance and legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Coder to the latest patched versions (2.34.2, 2.33.8, 2.32.7, or 2.29.17) immediately. If upgrading is not possible, restrict access to the login endpoint via network controls or WAF rules to limit exposure.

Useful 0 Not Useful 0