CVE-2026-45791: Dokploy

Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days.

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.

Affected products

• Dokploy Dokploy: before 0.29.6 (fixed in 0.29.6)

Published 2026-08-17. Last modified 2026-09-08.