Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck
CVE-2026-110130Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
Critical 10.0
In plain English
A critical-severity authentication bypass in dockhand from Finsys. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.
Affected products (as reported)
Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-r3mg-r5vm-3v6w) vendor-advisory
- VulnCheck Advisory: Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check third-party-advisory