Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.7, published 20 August 2026.

Which products and versions are affected?

Coder 2.34.0 before 2.34.2; 2.33.0 before 2.33.8; 2.30.0 before 2.32.7; before 2.29.17.

Is there a fix for This vulnerability?

A patch was published on 2026-06-10: Fix merged (PR #26205) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a hosted service.

Check whether you run Coder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Coder user enumeration in login endpoint via timing-based placeholder password

Severity: low · CVSS 3.7 · Published 2026-08-20

Coder is a platform providing remote development environments. The login function contained a flaw that allowed unauthenticated attackers to determine which usernames exist in the system and whether they use single sign-on or password authentication by submitting a specific password. While the vulnerability does not grant direct access to systems or data, it significantly aids attackers in targeting credential-stuffing campaigns and crafting phishing attacks.

Technologies: Coder. Vendors: Coder.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.7, published 20 August 2026.
Which products and versions are affected?: Coder 2.34.0 before 2.34.2; 2.33.0 before 2.33.8; 2.30.0 before 2.32.7; before 2.29.17.
Is there a fix for This vulnerability?: A patch was published on 2026-06-10: Fix merged (PR #26205) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a hosted service.
Am I affected?: Check whether you run Coder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `userpassword.Compare()` function, which implements timing-safe password comparison by substituting a known placeholder hash ("hunter2") when no stored hash is present (typical for SSO-only or nonexistent accounts). When an attacker submits "hunter2" as the login password, this placeholder hash matches, allowing the login-type check to execute and return an HTTP 403 (for SSO users, revealing the provider) or 401 (for password users), versus a generic failure for nonexistent accounts. This observable response discrepancy enables user enumeration without authentication. The attack vector is network-accessible and requires no privileges or user interaction. The fix replaces the static "hunter2" placeholder with a securely randomized value that cannot be guessed or matched by any user-supplied password. Patches are available in versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17 and later.

Affected products

Coder Coder 2.34.0 before 2.34.2; 2.33.0 before 2.33.8; 2.30.0 before 2.32.7; before 2.29.17

Timeline

2026-06-12: disclosed: Advisory published by GitHub
2026-06-10: patched: Fix merged (PR #26205)
2026-06-11: patched: Patches released for 2.32, 2.33, 2.29
2026-06-12: patched: Patch released for 2.34

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.