CVE-2026-111933
Low · 3.7CVSS
3.7
EPSS
0.2%
Published
Oct 17, 2026
CISA due date
—
The record
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-65626 The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a… CWE-203
- CVE-2026-76406 In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encrypted… CWE-203
- CVE-2026-114064 Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook… CWE-203
- CVE-2026-18560 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <=… CWE-203
- CVE-2026-97782 Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to… CWE-203
- CVE-2026-88834 A flaw was found in BusyBox's httpd web server. CWE-203
- CVE-2026-63573 Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap… CWE-203
- CVE-2026-63567 Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. CWE-203