Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Dockhand lets attackers reset passwords without authentication

CVE-2026-110130 · published 2 days ago
Summary

Versions of Dockhand older than 1.0.45 allow anyone on the network to change a user’s password, including the admin’s, without proving who they are. This happens because the system mistakenly treats certain file‑type requests as safe and skips the login check. Upgrade Dockhand to version 1.0.45 or later, or apply the vendor’s patch, to close the gap.

What to do
  • Update finsys dockhand to version 1.0.45 or later.
Affected software
VendorProductAffected versions
finsys dockhand < 1.0.45
Original advisory text
Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-288Authentication Bypass Using Alternate Path
Timeline
Published13 Oct 2026
Updated15 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-110130 · NVD
CVE-2026-110130 · MITRE
CVE-2026-110130 · OSV
GHSA-r3mg-r5vm-3v6w · GHSA
Track software like this
Free during beta