GHSA-8fxq-53rx-ph5f Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

• Go github.com/coder/coder/v2: >= 2.34.0, < 2.34.2 → fixed in 2.34.2 • Go github.com/coder/coder/v2: >= 2.33.0, < 2.33.8 → fixed in 2.33.8 • Go github.com/coder/coder/v2: >= 2.30.0, < 2.32.7 → fixed in 2.32.7 • Go github.com/coder/coder/v2: < 2.29.17 → fixed in 2.29.17

Summary `userpassword.Compare()` substituted a placeholder hash derived from the well-known string `"hunter2"` when the stored hash was empty. Submitting `"hunter2"` therefore matched accounts with no password hash (nonexistent users and SSO-only users) and a subsequent login-type check returned an HTTP 403 that disclosed the account's login type, versus 401 for password users. > Note: Practical exploitation is limited because the timing side channel is noisy and only reveals whether an account exists. Impact An unauthenticated attacker could enumerate valid accounts and their authentication provider by submitting logins with the password `"hunter2"`, distinguishing nonexistent users, SSO users (provider revealed) and password users from the response. This aids credential-stuffing and targeted phishing. No authentication bypass or data access resulted. Patches The fix derives the timing-defense placeholder from a secure random value that no supplied password can match. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 | Workarounds None. References • Fix: #26205 Credits We'd like to thank Anthropic's Security Team (ANT-2026-22433) for independently disclosing this issue!