Vulnerability GO-2026-6265
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 month ago
August 25, 2026 at 07:43 PM UTC
Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder
v0.1.0 - v0.27.3
v0.1.0 - v0.27.3
Summary
Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder
Details
Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison in github.com/coder/coder
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
1 month ago
Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder
v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GO-2026-6267
v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GO-2026-6267
Unknown
1 month ago
Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings in github.com/coder/coder
v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GO-2026-6267
v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GO-2026-6267
Low Risk
1 month ago
Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings
v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GHSA-h58c-xccx-75m3
v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GHSA-h58c-xccx-75m3
Low Risk
1 month ago
Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison
v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GHSA-8fxq-53rx-ph5f
v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GHSA-8fxq-53rx-ph5f
Unknown
3 months ago
Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder
v0.1.0 - v0.27.3 GO-2026-5916
v0.1.0 - v0.27.3 GO-2026-5916
Impacted packages
Timeline
Published
1 month ago
August 25, 2026 at 07:43 PM UTC
Fixed (v2.34.2)
4 months ago
June 11, 2026 at 08:12 PM UTC
Fixed (v2.33.8)
4 months ago
June 11, 2026 at 08:56 PM UTC
Fixed (v2.32.7)
4 months ago
June 11, 2026 at 09:29 PM UTC
Fixed (v2.29.17)
4 months ago
June 12, 2026 at 12:17 AM UTC
Last Modified
1 month ago
August 26, 2026 at 01:13 AM UTC