Authentication Bypass in Dockhand Affects All Versions Prior to 1.0.45
CVE-2026-110130

10CRITICAL

Key Information:

Vendor

Finsys

Status
Dockhand
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110130?

Dockhand prior to version 1.0.45 contains a serious authentication bypass vulnerability. This issue allows remote attackers, without proper authentication, to exploit the global auth hook, particularly for any path ending in static asset extensions like .js. Specifically, the vulnerability includes access to sensitive API routes such as /api/*, enabling unauthenticated users to send malicious PUT requests to endpoints like /api/users/.js. Through this exploit, attackers can reset passwords for admin accounts or any user accounts, leading to unauthorized access and account takeover.

Affected Version(s)

dockhand 0 < 1.0.45

dockhand 1.0.45

References

https://github.com/Finsys/dockhand/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/dockhand-before-1.0....
third-party-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Allan Victor
.