CVE-2026-45791

MediumCVSS 5.9

Published: 17/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

Dokploy is a free, self-hostable PaaS. Prior to 0.29.6, the user update procedure does not delete other session rows after a password change, allowing a compromised session token to remain valid for up to three days. This is fixed in version 0.29.6.

Risk Assessment

Risk of prolonged unauthorized access after password change, potentially leading to account compromise.

Recommendation

Upgrade Dokploy to version 0.29.6 or later.

Original NVD description (English source)

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.