This vulnerability arises because the authentication library substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit login attempts with the password "hunter2" and distinguish HTTP 403 responses from 401 responses, thereby determining whether a username is valid. In addition, the attack can reveal the authentication provider of SSO‑only users. The flaw is a characteristic of CWE‑203, an improper input validation weakness. The impact is primarily on confidentiality: an attacker can enumerate valid accounts and possibly gain insight into SSO configuration, but the vulnerability does not directly lead to code execution or data modification.

The flaw affects the Coder platform. Vulnerable versions are all releases before 2.29.17, any 2.30.x through 2.32.6, any 2.33.x through 2.33.7, and any 2.34.x through 2.34.1. Updated releases 2.34.2 and later contain the fix.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated remote access via the public authentication endpoint. An attacker only needs to send HTTP login requests and interpret status codes; no privileged access or network restrictions are required. Because the flaw only allows user enumeration, the immediate risk is the exposure of user identities and potential reconnaissance for later attacks. However, without additional exploitation capabilities, the threat remains within the enumeration domain.