CVE-2026-110256
Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.
| CWE | CWE-90 |
| Vendor | finsys |
| Product | dockhand |
| Published | Oct 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for finsys dockhand
Be the first to know when new low vulnerabilities affecting finsys dockhand are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
Finsys / dockhand
0 < 1.0.19
References
Credits
SENSEiXENUS