CVE-2026-111933

LowCVSS 3.7/10Last modified Oct 24, 2026

Description

Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-203

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 17, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1119343.7Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X CVE-2026-1119352.6NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local im CVE-2026-1119364.3Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never che CVE-2026-1119375.4Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Not CVE-2026-1119384.3Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call lo CVE-2026-1119394.6Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impers CVE-2026-111946.5Inappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a cr CVE-2026-1119424.3A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. Thi CVE-2026-111943On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated w CVE-2026-111946Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response b CVE-2026-1119475.5The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing ta CVE-2026-1119487.1The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on