CVE-2026-45791 in Dokploy
Summary
by MITRE • 08/18/2026
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in Dokploy versions prior to 0.29.6 represents a critical authentication state management flaw within the user update procedure. As a self-hostable Platform as a Service, Dokploy relies on robust session handling to ensure that only authorized users can access managed applications and infrastructure components. The specific defect resides in the server-side API router responsible for updating user accounts, specifically when an account password is modified. Under normal security expectations, changing a password should serve as a definitive revocation event for all existing authentication sessions associated with that account. This action signals to the system that previous credentials are no longer valid and that any active session tokens derived from those credentials must be invalidated immediately to prevent unauthorized access using stale or potentially compromised data.
The technical flaw occurs because the implementation of the password update function fails to invalidate or delete other rows in the session table corresponding to the affected user account. Consequently, when a user changes their password, the system updates the credential hash but leaves existing session tokens active and valid within the database. This creates a window of opportunity for attackers who may have obtained a better-auth.session_token through various means such as cross-site scripting attacks, network sniffing on unencrypted connections, or physical access to an unlocked workstation where the token is stored in local storage or cookies. Because these sessions remain valid for up to three days after the password change, an attacker can continue to authenticate and interact with the platform using the old session token even though the legitimate user has attempted to secure their account by changing the password.
The operational impact of this vulnerability is significant within a PaaS environment where multiple applications and services are managed under single or shared accounts. An adversary leveraging a compromised session token gains persistent access to the Dokploy dashboard, potentially allowing them to deploy malicious containers, exfiltrate sensitive application data, modify deployment configurations, or escalate privileges if administrative roles are involved. The three-day validity period exacerbates this risk by providing a prolonged window for exploitation before the attacker might be detected through anomalous activity logs or until the session naturally expires based on other timeout mechanisms that may not apply to all token types. This undermines the fundamental security principle of immediate revocation upon credential change, leaving organizations vulnerable even after they have taken corrective action regarding compromised passwords.
To mitigate this vulnerability and align with industry best practices for authentication state management, it is imperative to upgrade Dokploy to version 0.29.6 or later where the session invalidation logic has been corrected. For environments that cannot immediately patch due to operational constraints, administrators should manually purge all active sessions associated with any user who reports a potential compromise or changes their password as part of an incident response procedure. This involves deleting relevant entries from the database table storing session tokens for those specific users. Furthermore, organizations should implement additional controls such as short-lived access tokens paired with secure refresh token rotation mechanisms to limit the lifespan and utility of stolen credentials. Monitoring tools should be configured to alert on concurrent logins or unusual geographic locations associated with a single account to detect potential abuse of lingering sessions earlier than the default expiration time allows.
This vulnerability is classified under CWE-613, which refers to Insufficient Session Expiration, as it involves the failure to properly invalidate session identifiers after a significant security event like password modification. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, specifically in the context of persistence through valid credentials that were not revoked upon compromise detection or credential rotation. By addressing this flaw and adhering to strict session lifecycle management policies, organizations can significantly reduce their attack surface regarding authentication bypasses and unauthorized access within their Dokploy deployments.