# Coder user enumeration in login endpoint via timing-based placeholder password

Source: https://junglewise.ai/threats/coder-user-enumeration-in-login-endpoint-via-timing-based-placeholder-35423c9f  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.7 · Published 2026-08-20

Coder is a platform providing remote development environments. The login function contained a flaw that allowed unauthenticated attackers to determine which usernames exist in the system and whether they use single sign-on or password authentication by submitting a specific password. While the vulnerability does not grant direct access to systems or data, it significantly aids attackers in targeting credential-stuffing campaigns and crafting phishing attacks.

Technologies: [Coder](https://junglewise.ai/threats/technologies/coder). Vendors: [Coder](https://junglewise.ai/threats/vendors/coder).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.7, published 20 August 2026.

**Which products and versions are affected?** Coder 2.34.0 before 2.34.2; 2.33.0 before 2.33.8; 2.30.0 before 2.32.7; before 2.29.17.

**Is there a fix for This vulnerability?** A patch was published on 2026-06-10: Fix merged (PR #26205) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a hosted service.

**Am I affected?** Check whether you run Coder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `userpassword.Compare()` function, which implements timing-safe password comparison by substituting a known placeholder hash ("hunter2") when no stored hash is present (typical for SSO-only or nonexistent accounts). When an attacker submits "hunter2" as the login password, this placeholder hash matches, allowing the login-type check to execute and return an HTTP 403 (for SSO users, revealing the provider) or 401 (for password users), versus a generic failure for nonexistent accounts. This observable response discrepancy enables user enumeration without authentication. The attack vector is network-accessible and requires no privileges or user interaction. The fix replaces the static "hunter2" placeholder with a securely randomized value that cannot be guessed or matched by any user-supplied password. Patches are available in versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17 and later.

## Affected products

- Coder Coder 2.34.0 before 2.34.2; 2.33.0 before 2.33.8; 2.30.0 before 2.32.7; before 2.29.17

## Timeline

- 2026-06-12: disclosed: Advisory published by GitHub
- 2026-06-10: patched: Fix merged (PR #26205)
- 2026-06-11: patched: Patches released for 2.32, 2.33, 2.29
- 2026-06-12: patched: Patch released for 2.34

## References

- [https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f](https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f)
- [https://github.com/coder/coder/pull/26205](https://github.com/coder/coder/pull/26205)
- [https://github.com/coder/coder/commit/35a7dc8ab9c7f15ce05d963947823ee31224512f](https://github.com/coder/coder/commit/35a7dc8ab9c7f15ce05d963947823ee31224512f)
- [https://github.com/coder/coder/releases/tag/v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17)
- [https://github.com/coder/coder/releases/tag/v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7)
- [https://github.com/coder/coder/releases/tag/v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8)

## Related threats

- [Coder AI Gateway encoded path traversal](https://junglewise.ai/threats/cve-2026-121967-coder-2-28-0-before-2-29-22-2-30-0-before-2-34-13-2-35-0-before)
- [Coder missing audience validation in GCP instance-identity endpoint](https://junglewise.ai/threats/cve-2026-118687-coder-before-2-29-21-2-30-0-before-2-34-12-2-35-0-before-2-35-9)
- [Coder open redirect in workspace app proxy](https://junglewise.ai/threats/cve-2026-111931-coder-from-2-0-0-before-2-34-8-contains-an-open-redirect)
- [Coder workspace ACL endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-111930-coder-from-2-26-0-before-2-34-8-contains-an-incorrect)
- [Coder provisioner daemon authorization bypass in DownloadFile](https://junglewise.ai/threats/cve-2026-111929-coder-from-2-30-0-before-2-34-8-contains-an-authorization-bypass)