GHSA-8fxq-53rx-ph5f — Coder: Login endpoint user enumeration via timing-defense

Quick fix

GHSA-8fxq-53rx-ph5f — github.com/coder/coder/v2: upgrade to the fixed version with the command below.

go get github.com/coder/coder/v2@v2.34.2

Details

### Summary

`userpassword.Compare()` substituted a placeholder hash derived from the well-known string `"hunter2"` when the stored hash was empty. Submitting `"hunter2"` therefore matched accounts with no password hash (nonexistent users and SSO-only users) and a subsequent login-type check returned an HTTP 403 that disclosed the account's login type, versus 401 for password users.

> **Note:** Practical exploitation is limited because the timing side channel is noisy and only reveals whether an account exists.

### Impact

An unauthenticated attacker could enumerate valid accounts and their authentication provider by submitting logins with the password `"hunter2"`, distinguishing nonexistent users, SSO users (provider revealed) and password users from the response. This aids credential-stuffing and targeted phishing. No authentication bypass or data access resulted.

### Patches

The fix derives the timing-defense placeholder from a secure random value that no supplied password can match.

The fix was backported to all supported release lines:

| Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) |

### Workarounds

None.

### References

- Fix: #26205

### Credits

We'd like to thank Anthropic's Security Team (ANT-2026-22433) for independently disclosing this issue!