The vulnerability resides in Dockhand's tryLdapAuth function, where the supplied username is inserted directly into an LDAP search filter without escaping wildcard characters. An unauthenticated attacker can send patterns such as "a*" to the /api/auth/login endpoint and analyze the response timing, thereby determining which usernames exist. This flaw provides an attacker with information about account existence but does not grant authentication or further privileges. The weakness corresponds to LDAP injection (CWE‑90).

Finsys Dockhand versions up to and including 1.0.18 are affected. Any deployment that exposes the public authentication API endpoint /api/auth/login can be exploited. This includes all instances of Dockhand under the 1.0.18 release series.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation, although the potential for widespread user enumeration remains. The likely attack vector is remote, unauthenticated HTTP POST to /api/auth/login. An attacker can trigger the flaw without credentials and rely on timing analysis, giving them the ability to enumerate valid LDAP usernames across any exposed Dockhand instance.