{"id":"CVE-2026-110130","published":"2026-10-13T19:18:43.397","lastModified":"2026-10-14T17:18:23.827","description":"Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-288"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Finsys/dockhand/security/advisories/GHSA-r3mg-r5vm-3v6w","tags":[]},{"url":"https://www.vulncheck.com/advisories/dockhand-before-1.0.45-authentication-bypass-via-static-asset-check","tags":[]},{"url":"https://github.com/Finsys/dockhand/security/advisories/GHSA-r3mg-r5vm-3v6w","tags":[]}],"exploitRefs":[{"url":"https://github.com/Finsys/dockhand/security/advisories/GHSA-r3mg-r5vm-3v6w","tags":[]},{"url":"https://github.com/Finsys/dockhand/security/advisories/GHSA-r3mg-r5vm-3v6w","tags":[]}],"hasPoc":true,"ai":{"summary":"An authentication bypass flaw in Dockhand allows unauthenticated attackers to reset any user's password by sending a PUT request to a specific API endpoint with a static asset extension, enabling complete account takeover.","exploitability":"Very easy to exploit with no prerequisites - attackers only need to send a single PUT request to /api/users/<id>.js to reset passwords and gain access to any account.","blast_radius":"High impact across all user accounts since the vulnerability affects the global authentication hook that bypasses authentication for all static asset extensions, including API routes.","remediation":"Upgrade to Dockhand version 1.0.45 or later to fix the authentication bypass vulnerability.","detection":"Monitor for PUT requests to /api/users/* endpoints with .js extensions in web server logs, particularly those that result in password reset operations.","tags":["auth-bypass","web","api","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:44:46.095Z"}}