Dockhand Authentication Bypass Lets Attackers Reset User Passwords

Dockhand before 1.0.45 contains an authentication bypass vulnerability.

The global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes. The user-mutation handlers fail open for unauthenticated callers.

• Affected versions: before 1.0.45
• Attack: unauthenticated remote attacker sends a PUT request to /api/users/[id].js
• Impact: resets the admin's or any user's password and takes over the account