CVE-2026-110256

Low

Description

Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.

SeverityLow

CVSS3.7

Exploit probability—

ProductFinsys Dockhand

PublishedOct 13, 2026

First seenOct 13, 2026

Weakness typeCWE-90CWE-90

How to fix

Update

Finsys dockhand1.0.19 or later

Vendor advisories

github.com/Finsys/dockhand/security/advisories/GHSA-vmm5-cjvh-7vmv

Affected products

Product	Affected versions	Fixed in
Finsys dockhand	v < 1.0.19	1.0.19

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.