Dockhand versions prior to 1.0.45 contain an authentication bypass that allows any user to authenticate as any account after sending a specially crafted request. The global authentication hook incorrectly skips credential checks for any URL path ending with a static asset extension such as ".js", including those under the "/api/*" namespace. Additionally, the mutation handlers that update user data are configured to fail open, meaning they do not require authentication at all. The result is that an unauthenticated remote attacker can send a PUT request to an endpoint like "/api/users/<id>.js" to reset the password for that user, gaining unrestricted access to the target account.

The vulnerability affects the Finsys Dockhand product for all releases earlier than version 1.0.45. No specific patch version is listed other than the release date of 1.0.45 and newer, which are presumed to have fixed the issue.

The CVSS score of 10 indicates a critical severity, and the lack of an EPSS score means no data is available to estimate exploitation likelihood, but the description shows that an attacker only needs to send an unauthenticated HTTP PUT request to a predictable endpoint to reset a password. This can be carried out over unencrypted protocols or via standard HTTP traffic, making the attack straightforward. The vulnerability is not listed in the CISA KEV catalog, but the high severity and straightforward exploitation path raise the risk level dramatically for any organization running an affected version.