CVE-2026-110130GHSA-R3MG-R5VM-3V6W
Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 1.0.45
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: poc
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.
Affected versions
- Finsys dockhand
fixed in 1.0.45