GHSA-8fxq-53rx-ph5f: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

userpassword.Compare() substituted a placeholder hash derived from the well-known string "hunter2" when the stored hash was empty. Submitting "hunter2" therefore matched accounts with no password hash (nonexistent users and SSO-only users) and a subsequent login-type check returned an HTTP 403 that disclosed the account’s login type, versus 401 for password users.

Note: Practical exploitation is limited because the timing side channel is noisy and only reveals whether an account exists.