CVE-2026-110130

Katalog CVE

CVSS 10.0 · Critical

Kerentanan Authentication Bypass Using an Alternate Path or Channel. Skor CVSS 3.1 10.0 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.

Rincian

Terbit di NVD

13 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

10.0 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/Finsys/dockhand/security/advisories/GHSA-r3mg-r5vm-3v6w
• https://www.vulncheck.com/advisories/dockhand-before-1.0.45-authentication-bypass-via-static-asset-check