{"id":"GO-2026-6265","revision":"f3ce843daecc4229b0231d1b5412122a","records":[{"revision":"f3ce843daecc4229b0231d1b5412122a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6265","aliases":["CVE-2026-111933","GHSA-8fxq-53rx-ph5f"],"title":"Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder","description":"Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder","state":0,"publishedAt":"2026-08-25T19:43:10+00:00","modifiedAt":"2026-10-18T10:55:40.9943988+00:00","affected":[{"ecosystem":"Go","name":"github.com/coder/coder","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/coder/coder/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.29.17"},{"kind":"introduced","version":"2.30.0"},{"kind":"fixed","version":"2.32.7"},{"kind":"introduced","version":"2.33.0"},{"kind":"fixed","version":"2.33.8"},{"kind":"introduced","version":"2.34.0"},{"kind":"fixed","version":"2.34.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f","https://github.com/coder/coder/commit/35a7dc8ab9c7f15ce05d963947823ee31224512f","https://github.com/coder/coder/pull/26205","https://github.com/coder/coder/releases/tag/v2.29.17","https://github.com/coder/coder/releases/tag/v2.32.7","https://github.com/coder/coder/releases/tag/v2.33.8","https://github.com/coder/coder/releases/tag/v2.34.2"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6265","license":"OSV · upstream source license applies","key":"osv:GO-2026-6265","identifiers":["GO-2026-6265","CVE-2026-111933","GHSA-8fxq-53rx-ph5f"]},"retained":false,"historicalAffected":[]}],"coverage":[]}