CVE-2026-111933: coder 2.34.0 to before 2.34.2, 2.33.0 to before 2.33.8, 2.30.0 to before 2.32.7 (+1 more affected versions)

Affected technology

coder · 2.34.0 to before 2.34.2
coder

coder · 2.33.0 to before 2.33.8
coder

coder · 2.30.0 to before 2.32.7
coder

coder · 0 to before 2.29.17
coder

Description’s affected range: before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality impact as low; integrity and availability impact as none.