External risk intelligence

Dockhand Authentication Bypass via Static Asset Path and User Mutation Handler Failure

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-110130

The vulnerability affects a web-based application (Dockhand) and specifically involves unauthorized access to API endpoints (/api/*). Since these are commonly deployed as internet-facing web services or APIs to manage user accounts and application functions, the vulnerable surface is likely to be reachable from the internet.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Dockhand, a web-based application, has a critical flaw that allows unauthenticated remote attackers to bypass security checks. This bypass enables attackers to reset any user's password by sending a specific PUT request to an API endpoint that incorrectly handles static asset file extensions. This vulnerability could lead to unauthorized account takeover.

Attackers can reset any user password.
Unauthenticated access to sensitive functions is possible.
Confirm if Dockhand is deployed and exposed externally.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted PUT request to an API endpoint that is designed to handle user mutations. Because the application incorrectly bypasses authentication for requests ending in static-asset extensions, such as `.js`, and fails to properly validate unauthenticated callers, an attacker can use this flaw to reset any user's password, including an administrator's, and gain complete control over the account.

Unauthenticated remote access required.
PUT request to a specific API path.
Full account takeover possible.

Live Threat

Current exploitation, exposure, and threat context

The described vulnerability could allow unauthenticated remote attackers to bypass authentication and reset user passwords through specific API paths. This could affect the integrity and availability of user accounts and administrative functions within the Dockhand application when supported by the advisory.

User account data could be compromised.
Attackers could send crafted PUT requests to API paths.
Unauthorized account control and data manipulation are possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application and platform teams responsible for Dockhand should prioritize identifying all deployments, confirming their reachability and criticality, and assigning ownership for remediation. The first practical step is to locate affected instances, assess their exposure, and then plan updates or mitigations based on the business risk.

Application owners must lead remediation efforts.
Verify external-facing instances and API usage first.
Plan maintenance for timely patching or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dockhand?

Dockhand is a web-based application designed to manage user accounts and application functions. Because it provides an interface for administrative tasks and user data handling, it is typically deployed as a web service that requires secure authentication to protect sensitive operations.

What does CWE-288 mean for CVE-2026-110130?

CWE-288 refers to authentication bypass via an alternate path or channel. In this CVE, the software incorrectly trusts requests that appear to be static assets, such as files ending in .js. This logic error allows an attacker to interact with restricted API routes without proving their identity, effectively skipping the security gates meant to protect user management features.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending a specially crafted PUT request to an API endpoint while appending a .js extension to the path. The application's global authorization hook erroneously treats this request as a static file and grants access. Crucially, requests that do not follow this pattern or do not target user-mutation handlers do not trigger this specific bypass mechanism.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies this vulnerability as likely reachable if your Dockhand instance is internet-facing. Because the bug resides within API endpoints that manage sensitive user data, any deployment accessible from the public internet creates a clear path for remote, unauthenticated attackers to interact with your system.

How should I respond to this vulnerability?

Your first step is to inventory all active Dockhand deployments to confirm which instances are running versions before 1.0.45. Prioritize identifying systems exposed to the internet, as these present the highest risk. Coordinate with your application owners to schedule updates, focusing on removing the insecure path handling that allows unauthenticated user modifications.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.