An authentication bypass in Finsys Dockhand before version 1.0.45 lets unauthenticated remote attackers reset any user's password, including the admin's, and take over the account. It is rated CVSS 10.0 (Critical).
What Is It
CVE-2026-110130 is an authentication bypass in Dockhand, classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Dockhand's global authentication hook skips authentication for any request path that ends in a static-asset extension such as .js. The check also applies to /api/* routes.
A second flaw makes this worse: the user-mutation handlers fail open when the caller is unauthenticated. An attacker can send a PUT request to /api/users/<id>.js to reset the password of the admin or any other user, then log in as that user.
VulnCheck disclosed the issue, and NVD published it on 2026-10-13. NVD lists its status as "Awaiting Analysis."
Why It Matters
The flaw gets the highest possible scores from both CVSS versions provided:
- CVSS 3.1: 10.0 Critical (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 10.0 Critical (secondary score from VulnCheck)
The attack works over the network, has low complexity, and needs no privileges or user interaction. The CVSS 3.1 scope is marked "Changed," which means the impact can reach beyond the vulnerable component. Confidentiality, integrity and availability impacts are all rated High. Exploitation means full account takeover, including the administrator account.
Exploitation status: The supplied CISA KEV entry is empty, so CISA's Known Exploited Vulnerabilities catalog does not confirm active exploitation of this CVE. The CVSS 4.0 exploit maturity field is "Not Defined."
What's Vulnerable
- Vendor: Finsys
- Product: dockhand (
pkg:github/Finsys/dockhand) - Affected: all versions from 0 up to, but not including, 1.0.45
- Unaffected: 1.0.45
The NVD record lists no CPE entries yet.
Patch Status
According to the affected-version data, the fix is in Dockhand 1.0.45. Anyone running an earlier version should upgrade to 1.0.45 or later. Since the bypass needs no authentication and can be reached remotely, internet-facing instances should be upgraded first. No CISA required action is listed, because this CVE has no KEV entry.