CVE-2026-110130

Summary

An authentication bypass flaw in Dockhand allows unauthenticated attackers to reset any user's password by sending a PUT request to a specific API endpoint with a static asset extension, enabling complete account takeover.

Exploitability

Very easy to exploit with no prerequisites - attackers only need to send a single PUT request to /api/users/<id>.js to reset passwords and gain access to any account.

Blast radius

High impact across all user accounts since the vulnerability affects the global authentication hook that bypasses authentication for all static asset extensions, including API routes.

Detection

Monitor for PUT requests to /api/users/* endpoints with .js extensions in web server logs, particularly those that result in password reset operations.

Prioritized remediation

Upgrade to Dockhand version 1.0.45 or later to fix the authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.