{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/dockhand--1.0.45/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:dockhand:dockhand:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-110130"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Dockhand (\u003c 1.0.45)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","api-vulnerability","account-takeover","cve-2026-110130"],"_cs_type":"advisory","_cs_vendors":["Dockhand"],"content_html":"\u003cp\u003eDockhand versions prior to 1.0.45 are affected by a critical authentication bypass vulnerability (CVE-2026-110130) located in the global authentication hook mechanism. The vulnerability stems from an insecure implementation where the application skips authentication checks for any HTTP request path ending in a static-asset extension, such as .js.\u003c/p\u003e\n\u003cp\u003eDefenders must note that this bypass extends to the /api/* routing namespace. Because the user-mutation handlers in these versions fail open for unauthenticated callers, an attacker can craft a PUT request to specific API endpoints by appending a static extension (e.g., /api/users/\u0026lt;id\u0026gt;.js). This allows unauthenticated remote actors to interact with sensitive user-management functions, such as resetting the password for any account including administrative users, ultimately leading to total system compromise and account takeover.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full account takeover, including administrative access to the Dockhand platform. This enables unauthorized actors to manage system configurations, exfiltrate sensitive data, and perform destructive actions within the application environment. The severity is marked as critical (CVSS 10.0), given the ease of exploitation and the high level of access granted to an attacker.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the application immediately by upgrading Dockhand to version 1.0.45 or later.\u003c/li\u003e\n\u003cli\u003eImplement web application firewall (WAF) rules to inspect and block PUT requests to /api/users/ routes that contain file extensions in the URL path.\u003c/li\u003e\n\u003cli\u003eAudit webserver and application logs for suspicious PUT requests targeting the /api/users/ endpoint, specifically those ending in .js extensions.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules in this brief to detect anomalous API access patterns if direct patching is delayed.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T20:38:38Z","date_published":"2026-10-13T20:38:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-dockhand-auth-bypass/","summary":"Dockhand versions prior to 1.0.45 allow unauthenticated remote attackers to perform full account takeover by exploiting an authentication bypass flaw in the global hook that incorrectly permits requests ending in static extensions.","title":"Authentication Bypass in Dockhand via Static Extension Path Traversal","url":"https://feed.craftedsignal.io/briefs/2026-10-dockhand-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Dockhand (\u003c 1.0.45)","version":"https://jsonfeed.org/version/1.1"}