CVE-2026-110256: Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth
Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Dockhand deployments through version 1.0.18 that use LDAP authentication are exposed. The affected login path is /api/auth/login, and exploitation can be performed without authentication.
What does an attacker need to exploit it?
An attacker needs network access to the login endpoint and must be able to submit crafted usernames containing LDAP wildcard characters. They can use incremental patterns such as 'a*' and observe response timing to identify valid LDAP usernames.
Does per-username rate limiting prevent exploitation?
No. The described wildcard-based technique can evade per-username rate limiting while enumerating usernames.
How can I determine whether my deployment is affected?
Check whether Dockhand is version 1.0.18 or earlier and whether LDAP authentication is enabled. Affected deployments pass login usernames into an LDAP search filter in tryLdapAuth without escaping wildcard characters.