LDAP Injection Vulnerability in Finsys Dockhand Product

CVE-2026-110256

What is CVE-2026-110256?

Finsys Dockhand versions up to 1.0.18 are vulnerable to an LDAP injection attack through the tryLdapAuth function. This vulnerability occurs because the login username is incorporated into the LDAP search filter without proper escaping of wildcard characters. Unauthenticated attackers can exploit this by submitting incremental wildcard patterns during the login process. By manipulating inputs to the /api/auth/login endpoint, attackers can measure response times to successfully enumerate valid LDAP usernames, thus circumventing any per-username rate limiting measures that may be in place.

References