CVE-2026-110256GHSA-vmm5-cjvh-7vmv
Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth
Finsys dockhand
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.32%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.0.19dockhandCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.
Text from CVE List
Affected versions 2
- dockhandaffected: all versions before 1.0.19CVE List
- dockhandunaffected: 1.0.19CVE List