What’s Vulnerable › Vulnerabilities

CVE-2026-110256: Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-26
• Weakness: CWE-90

Description

Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.

Affected products

• Finsys dockhand: before 1.0.19 — fixed in 1.0.19

How to fix

Upgrade to a fixed version: Finsys dockhand 1.0.19. Check the vendor advisory for mitigations.

References

• https://github.com/Finsys/dockhand/security/advisories/GHSA-vmm5-cjvh-7vmv
• https://www.vulncheck.com/advisories/dockhand-before-1.0.19-username-enumeration-via-ldap-injection-in-tryldapauth
• https://github.com/Finsys/dockhand/security/advisories/GHSA-vmm5-cjvh-7vmv

Get alerted when CVE-2026-110256 or the next vulnerability affects your stack