Dockhand versions prior to 1.0.50 suffer a critical privilege escalation flaw caused by the omission of validation for several OpenID Connect JWT claims—issuer, audience, nonce, and expiration. As a result, an attacker who can obtain valid OIDC tokens from another tenant—such as an administrator of a shared tenant in Microsoft Entra ID—can craft a token that is accepted by Dockhand as if it were issued by its own tenant. The unvalidated token allows the attacker to map an existing administrative group to the Dockhand application and assume the role of a Dockhand administrator. This elevates the attacker’s privileges from their original tenant user level to full administrative control over the target Dockhand instance, enabling arbitrary configuration changes, data exfiltration, or further lateral movement within the network.

The vulnerability affects deployments of Finsys Dockhand version 1.0.49 and earlier. Users of Dockhand before 1.0.50 who rely on OIDC authentication must be aware of this risk and verify that their environment is patched or mitigated.

The flaw carries a CVSS score of 9.2, indicating a high severity level. Although no EPSS score is publicly available, the vulnerability is not listed in CISA KEV, suggesting limited public exploitation to date. The likely attack vector involves an authorized administrator of a different tenant within the same identity provider. By impersonating the OIDC client used by Dockhand, the attacker evades tenant isolation checks and gains administrative access. The conditions for exploitation are modest: the attacker must have administrator rights in another tenant that shares the same OIDC identity provider as the victim Dockhand instance.