EXPOSURES › CVE-2026-110130
CVE-2026-110130
CRITICALAn authentication bypass in Dockhand before 1.0.45 lets unauthenticated attackers reset any user's password via a PUT request to /api/users/<id>.js.
The global auth hook skips authentication for paths ending in .js, including /api/* routes, and user-mutation handlers fail open. Unauthenticated remote attackers can exploit this to take over accounts, including admin accounts. DIB orgs must ensure all software is patched to prevent account takeover and ensure compliance with access control requirements.
Shame score — An authentication bypass allowing unauthenticated attackers to reset any user's password is a severe, avoidable failure that directly enables account takeover and violates access control principles.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.