https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 06:24:17 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-111933 <p>Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string &#34;hunter2&#34; when a stored password hash is empty. Unauthenticated attackers can submit logins with the password &#34;hunter2&#34; and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.</p> <p>Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string &#34;hunter2&#34; when a stored password hash is empty. Unauthenticated attackers can submit logins with the password &#34;hunter2&#34; and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.</p> https://db.gcve.eu/vuln/fkie_cve-2026-111933 https://db.gcve.eu/vuln/ghsa-wwfw-5crg-94f6 <p>Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string &#34;hunter2&#34; when a stored password hash is empty. Unauthenticated attackers can submit logins with the password &#34;hunter2&#34; and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.</p> <p>Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string &#34;hunter2&#34; when a stored password hash is empty. Unauthenticated attackers can submit logins with the password &#34;hunter2&#34; and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.</p> https://db.gcve.eu/vuln/ghsa-wwfw-5crg-94f6