CVE-2026-111933 coder CVE debrief

Who should care

Defenders responsible for managing Coder environments should be aware of this vulnerability and take steps to verify the versions in use and apply patches. This includes developers, system administrators, and security professionals who work with Coder or are responsible for securing coding environments.

Why it matters

CVE-2026-111933 is a user enumeration vulnerability in Coder that allows unauthenticated attackers to distinguish between valid and invalid accounts and reveal authentication providers. Defenders should verify Coder versions, apply patches, and monitor for unauthorized login attempts to prevent account enumeration attacks.

• Enumeration of valid accounts, potentially leading to targeted attacks.
• Reveal authentication providers of SSO-only users, which could be used to plan phishing or other social engineering attacks.
• Potential for brute-force attacks on user accounts using the 'hunter2' password as a starting point.

Technical summary

The vulnerability is caused by the userpassword.Compare() function substituting a placeholder hash derived from the string 'hunter2' when a stored password hash is empty. This allows unauthenticated attackers to submit logins with the password 'hunter2' and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users. The affected versions of Coder are before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2. Defenders should prioritize verifying the versions of Coder in use and applying patches to prevent exploitation.

Defensive priority

Defenders should prioritize verifying the versions of Coder in use and applying patches to prevent exploitation. This involves checking the current version of Coder and comparing it to the affected versions (before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2).

Recommended defensive actions

• Verify the current version of Coder and compare it to the affected versions.
• Apply patches to update Coder to version 2.29.17 or later, 2.32.7 or later, 2.33.8 or later, or 2.34.2 or later.
• Monitor for unauthorized login attempts and implement additional security measures to prevent account enumeration attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The evidence for this vulnerability comes from the CVE Program record and the NVD vulnerability detail page. Additional information is provided by source references from [email protected], including advisories from GitHub and Vulncheck.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.