Dockhand Auth Bypass CVE-2026-110130 Allows Remote Account Takeover

A critical authentication bypass vulnerability in Dockhand software allows unauthenticated remote attackers to take over user accounts, including those of system administrators. The National Vulnerability Database has assigned the flaw CVE-2026-110130 and rated it with a maximum CVSS score of 10.0, indicating severe risk to affected systems.

The vulnerability affects all versions of Dockhand prior to 1.0.45. According to the NVD record, the issue stems from a global authentication hook that incorrectly skips security checks for any request path ending in a static-asset file extension, such as .js. This logic error extends to API routes, meaning protected endpoints are not properly secured when accessed with these specific suffixes.

Technical Details of the Vulnerability

The core weakness is classified under CWE-288, which relates to authentication issues. The Dockhand application fails to enforce authentication for paths that appear to serve static assets. Consequently, an attacker can bypass login requirements by appending a .js extension to API endpoints. This allows the execution of privileged actions without valid credentials.

Specifically, the user-mutation handlers in the application fail open for callers who have not authenticated. An attacker can exploit this by sending a PUT request to the endpoint /api/users/<id>.js. This request structure tricks the authentication hook into treating the API call as a request for a static JavaScript file, thereby skipping the identity verification step entirely.

Impact and Affected Systems

The primary consequence of this flaw is complete account takeover. By resetting the password of any user ID, an attacker gains full access to that account. This includes administrative accounts, which typically have elevated privileges and broader access to system resources and data. The ability to reset passwords remotely without authentication poses a significant threat to the integrity of any deployment using vulnerable versions.

There is no mention of active exploitation in the wild within the provided source material. However, the ease of exploitation—requiring only a single HTTP request with a modified path—makes the vulnerability highly attractive to threat actors. Any organization running Dockhand versions earlier than 1.0.45 is considered at risk until the software is updated.

What should you do?

Security teams should immediately audit their environments to identify any instances of Dockhand running versions prior to 1.0.45. If vulnerable versions are found, they should be upgraded to the patched version as soon as possible. Until an update is applied, network-level controls should be implemented to block unauthenticated PUT requests to API endpoints, particularly those with static-file extensions.

What to do and how to stay safe: Dockhand

• Scan your infrastructure to identify all installations of Dockhand software and verify their current version numbers against the affected range.
• Restrict network access to the Dockhand API endpoints to prevent unauthenticated external requests from reaching the application server.
• Monitor server logs for unusual PUT requests targeting paths ending in .js or other static extensions, which may indicate exploitation attempts.
• Implement strict input validation on API routes to ensure that authentication checks are enforced regardless of the requested file extension.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific versions of Dockhand are vulnerable to CVE-2026-110130?

All versions of Dockhand prior to 1.0.45 are affected by this authentication bypass vulnerability.

How can an attacker exploit this vulnerability?

An attacker can send a PUT request to /api/users/<id>.js to bypass authentication and reset a user's password.

What is the severity rating for this CVE?

The National Vulnerability Database rates CVE-2026-110130 as critical with a CVSS score of 10.0.