EUVD-2026-33355Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789") lets an unauthenticated attacker forge email verification JWTs, trigger auto-sign-in as admin, and execute commands on the host via the built-in SSH terminal. This vulnerability is fixed in 0.29.3.
AnalysisAI
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs using a hardcoded BETTER_AUTH_SECRET fallback ('better-auth-secret-123456789'), auto-sign-in as admin, and run arbitrary commands on the host through the built-in SSH terminal. The flaw carries a CVSS 10.0 score with network attack vector and no required privileges, and while no public exploit is identified at time of analysis, the trivially guessable secret makes weaponization straightforward.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Required: network reachability to a Dokploy 0.27.0-0.29.2 web interface where the operator did NOT override the default BETTER_AUTH_SECRET environment variable (the hardcoded fallback 'better-auth-secret-123456789' must be active). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to maximum priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans the internet for exposed Dokploy login pages, identifies a target running 0.27.0-0.29.2, and uses the publicly known 'better-auth-secret-123456789' to sign a forged email-verification JWT for a chosen email address. Submitting the forged token to Dokploy's verification endpoint triggers the auto-sign-in flow as an admin, after which the attacker opens the built-in browser-based SSH terminal and executes arbitrary shell commands on the host - pivoting into deployed containers, stealing application secrets, and persisting via cron or SSH key implantation. |
| Remediation | Upgrade immediately to Dokploy 0.29.3 or later, which is the vendor-released patch per the GitHub Security Advisory GHSA-w3gm-rc4p-9rhj (https://github.com/Dokploy/dokploy/security/advisories/GHSA-w3gm-rc4p-9rhj). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all Dokploy instances in production and confirm versions; restrict network access to Dokploy management interfaces to trusted internal networks only via firewall rules; review access logs for suspicious activity and failed authentication attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today