Dockhand Critical Flaw Lets Attackers Reset Passwords via API Without Auth in Pre-1.0.45 Versions

A critical authentication bypass in Dockhand enables remote attackers to take over user accounts without credentials. Security teams must verify their installations are updated to version 1.0.45 or later to mitigate this immediate risk.

What happened

The National Vulnerability Database records CVE-2026-110130 as a critical flaw in Dockhand versions prior to 1.0.45. The issue stems from a misconfigured global authentication hook that incorrectly skips security checks for any request path ending in a static-asset extension, such as .js. This logic error extends to API routes, meaning requests to /api/* endpoints are not properly authenticated if they include these file extensions.

Attackers can exploit this by sending a PUT request to a modified path like /api/users/<id>.js. This action targets user-mutation handlers that fail open for unauthenticated callers, allowing the attacker to reset the password for any user account. Consequently, an unauthenticated remote attacker can seize control of administrator or standard user accounts within the affected environment.

Why it matters

This vulnerability is rated CVSS 10.0, indicating the highest level of severity. It falls under CWE-288, which covers authentication issues. The ability to reset passwords for any user, including privileged administrators, provides a direct path for complete system compromise. Environments running Dockhand versions older than 1.0.45 are exposed to this remote takeover vector without any additional exploitation complexity.

Next steps

• Verify the current version of Dockhand deployed in all environments.
• Upgrade immediately to version 1.0.45 or later to apply the vendor fix.
• Audit recent logs for unusual PUT requests to user API endpoints.
• Reset passwords for any accounts that may have been targeted during the exposure window.

Detection notes

Security operations teams should monitor web server logs for anomalous HTTP methods targeting user management endpoints. Look specifically for PUT or POST requests directed at paths containing static file extensions like .js or .css, which are unusual for API interactions. Alert on successful password reset events originating from unauthenticated sessions or unfamiliar IP addresses. Review access logs for sequences where authentication checks were bypassed, indicated by successful responses to requests that lacked valid session tokens. Investigate any sudden changes to user credentials or permission levels that do not correlate with administrative activity.

What to do and how to stay safe: Dockhand

• Check all Dockhand installations for versions prior to 1.0.45 and upgrade immediately.
• Monitor authentication logs for failed or bypassed login attempts on API routes.
• Implement strict input validation to reject requests with unexpected file extensions in API paths.
• Review user account activity for unauthorized password changes or privilege escalations.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Dockhand are affected by CVE-2026-110130?

All versions of Dockhand prior to 1.0.45 are affected by this authentication bypass vulnerability.

How can an attacker exploit this flaw?

Attackers send a PUT request to /api/users/<id>.js to reset a user's password without authentication.

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-110130 with a CVSS score of 10.0, which is Critical.