Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

Summary

userpassword.Compare() substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash (nonexistent users and SSO-only users) and a subsequent login-type check returned an HTTP 403 that disclosed the account's login type, versus 401 for password users.

Note: Practical exploitation is limited because the timing side channel is noisy and only reveals whether an account exists.

Impact

An unauthenticated attacker could enumerate valid accounts and their authentication provider by submitting logins with the password "hunter2", distinguishing nonexistent users, SSO users (provider revealed) and password users from the response. This aids credential-stuffing and targeted phishing. No authentication bypass or data access resulted.

Patches

The fix derives the timing-defense placeholder from a secure random value that no supplied password can match.

The fix was backported to all supported release lines:

| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |

Workarounds

None.

References

• Fix: #26205

Credits

We'd like to thank Anthropic's Security Team (ANT-2026-22433) for independently disclosing this issue!