CVE-2026-110130
criticalDockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension suc…
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/.js to reset the admin's or any user's password and take over the account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/Finsys/dockhand/security/advisories/GHSA-r3mg-r5vm-3v6w disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/dockhand-before-1.0.45-authentication-bypass-via-stat... disclosure@vulncheck.com
- https://github.com/Finsys/dockhand/security/advisories/GHSA-r3mg-r5vm-3v6w 134c704f-9b21-4f2e-91b3-4a467353bcc0