GHSA-8fxq-53rx-ph5f

Source

https://github.com/advisories/GHSA-8fxq-53rx-ph5f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-8fxq-53rx-ph5f/GHSA-8fxq-53rx-ph5f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8fxq-53rx-ph5f

Published

2026-08-20T18:34:21Z

Modified

2026-08-20T18:45:19.267525440Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Details

Summary

userpassword.Compare() substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash (nonexistent users and SSO-only users) and a subsequent login-type check returned an HTTP 403 that disclosed the account's login type, versus 401 for password users.

Note: Practical exploitation is limited because the timing side channel is noisy and only reveals whether an account exists.

Impact

An unauthenticated attacker could enumerate valid accounts and their authentication provider by submitting logins with the password "hunter2", distinguishing nonexistent users, SSO users (provider revealed) and password users from the response. This aids credential-stuffing and targeted phishing. No authentication bypass or data access resulted.

Patches

The fix derives the timing-defense placeholder from a secure random value that no supplied password can match.

The fix was backported to all supported release lines:

| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |

Workarounds

None.

References

Fix: #26205

Credits

We'd like to thank Anthropic's Security Team (ANT-2026-22433) for independently disclosing this issue!

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": null,
    "severity": "LOW",
    "github_reviewed_at": "2026-08-20T18:34:21Z",
    "cwe_ids": [
        "CWE-203",
        "CWE-204"
    ]
}

References

Affected packages

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.34.0

Fixed

2.34.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-8fxq-53rx-ph5f/GHSA-8fxq-53rx-ph5f.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.33.0

Fixed

2.33.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-8fxq-53rx-ph5f/GHSA-8fxq-53rx-ph5f.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.30.0

Fixed

2.32.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-8fxq-53rx-ph5f/GHSA-8fxq-53rx-ph5f.json"

Go / github.com/coder/coder/v2

Package

Name: github.com/coder/coder/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/coder/coder/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.29.17

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-8fxq-53rx-ph5f/GHSA-8fxq-53rx-ph5f.json"