Dockhand 1.0.45 fixes a CVSS 10 authentication bypass: any request path ending in .js skips login
Dockhand before 1.0.45 skips authentication for request paths ending in .js, so one unauthenticated PUT resets the admin password. CVE-2026-110130 scores CVSS 10.0.
· 6 min