Junglewise Threat Intelligence

Coder user enumeration in login endpoint via timing-based placeholder password

Severity: low · CVSS 3.7 · Published 2026-08-20

Executive brief

Coder is a platform providing remote development environments. The login function contained a flaw that allowed unauthenticated attackers to determine which usernames exist in the system and whether they use single sign-on or password authentication by submitting a specific password. While the vulnerability does not grant direct access to systems or data, it significantly aids attackers in targeting credential-stuffing campaigns and crafting phishing attacks.

Technical details

The vulnerability exists in the `userpassword.Compare()` function, which implements timing-safe password comparison by substituting a known placeholder hash ("hunter2") when no stored hash is present (typical for SSO-only or nonexistent accounts). When an attacker submits "hunter2" as the login password, this placeholder hash matches, allowing the login-type check to execute and return an HTTP 403 (for SSO users, revealing the provider) or 401 (for password users), versus a generic failure for nonexistent accounts. This observable response discrepancy enables user enumeration without authentication. The attack vector is network-accessible and requires no privileges or user interaction. The fix replaces the static "hunter2" placeholder with a securely randomized value that cannot be guessed or matched by any user-supplied password. Patches are available in versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17 and later.

Affected products

  • Coder Coder 2.34.0 before 2.34.2; 2.33.0 before 2.33.8; 2.30.0 before 2.32.7; before 2.29.17

Timeline

  • 2026-06-12: disclosed: Advisory published by GitHub
  • 2026-06-10: patched: Fix merged (PR #26205)
  • 2026-06-11: patched: Patches released for 2.32, 2.33, 2.29
  • 2026-06-12: patched: Patch released for 2.34

References

Related threats