CVE-2026-110256
CVE-2026-110256 · Dockhand before 1.0.19 Username Enumeration via LDAP Injection in tryLdapAuth
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can submit incremental wildcard patterns such as 'a*' to /api/auth/login and measure response timing to enumerate valid LDAP usernames while evading per-username rate limiting.
CVSS 6.3 · Media · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
dockhand
- Versiones
- ≥ 0, < 1.0.19: Afectada (semver)
- 1.0.19: No afectada (semver)
Actualiza a 1.0.19