What is the CVSS score of CVE-2026-45631?

CVE-2026-45631 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dokploy are affected by CVE-2026-45631?

Dokploy versions 0.27.0-0.29.2 expose a critical authentication bypass allowing any unauthenticated attacker to execute arbitrary commands on production hosts.. A patch is available.

How to fix or mitigate CVE-2026-45631?

24 hours: Identify all Dokploy instances in production and confirm versions; restrict network access to Dokploy management interfaces to trusted internal networks only via firewall rules; review access logs for suspicious activity and failed authentication attempts. 7 days: Monitor vendor for patch release to 0.29.3 or later and plan upgrade; if no patched version available by day 7, disable or isolate the SSH terminal API endpoint; immediately rotate all admin credentials and API keys. 30 days: Deploy patched Dokploy version to all instances; conduct full forensic audit of access logs and system command history across all affected deployments; implement persistent network segmentation isolating deployment management access; establish continuous monitoring for SSH terminal and authentication bypass attempts.

Dokploy CVE-2026-45631

EUVD-2026-33355 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-05-29 GitHub_M

Authentication Bypass Dokploy

10.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 29, 2026 - 19:01 EUVD

Source Code Evidence Fetched

May 29, 2026 - 17:53 vuln.today

Analysis Generated

May 29, 2026 - 17:53 vuln.today

DescriptionCVE.org

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789") lets an unauthenticated attacker forge email verification JWTs, trigger auto-sign-in as admin, and execute commands on the host via the built-in SSH terminal. This vulnerability is fixed in 0.29.3.

AnalysisAI

Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs using a hardcoded BETTER_AUTH_SECRET fallback ('better-auth-secret-123456789'), auto-sign-in as admin, and run arbitrary commands on the host through the built-in SSH terminal. The flaw carries a CVSS 10.0 score with network attack vector and no required privileges, and while no public exploit is identified at time of analysis, the trivially guessable secret makes weaponization straightforward.

Technical ContextAI

Dokploy is a self-hostable Platform-as-a-Service (PaaS) similar to Heroku/Vercel that uses the better-auth authentication library for session and email-verification token management. better-auth signs JWTs (including the email verification token consumed during sign-up/sign-in flows) with the BETTER_AUTH_SECRET environment variable; when operators failed to set this variable, Dokploy fell back to the literal string 'better-auth-secret-123456789' baked into the source. This is a textbook CWE-798 (Use of Hard-coded Credentials) issue: because the secret is public knowledge in the source tree, any attacker can mint valid signed tokens. Combined with Dokploy's built-in browser SSH terminal - a feature intentionally exposed to authenticated admins for managing the host running the PaaS - token forgery escalates directly to host command execution.

RemediationAI

Upgrade immediately to Dokploy 0.29.3 or later, which is the vendor-released patch per the GitHub Security Advisory GHSA-w3gm-rc4p-9rhj (https://github.com/Dokploy/dokploy/security/advisories/GHSA-w3gm-rc4p-9rhj). As a pre-upgrade workaround, set a strong, randomly generated BETTER_AUTH_SECRET environment variable (e.g., 'openssl rand -base64 48') and restart Dokploy - this breaks the hardcoded-fallback code path and invalidates any tokens an attacker may have already forged (existing legitimate sessions will also need to re-authenticate). If patching is not immediately possible, additionally restrict the Dokploy web UI to a VPN or trusted IP allowlist via a reverse proxy or host firewall, since the attack requires network reachability to the auth endpoint; note this still leaves any user who can reach the UI (including internal attackers) able to exploit. After patching, rotate the BETTER_AUTH_SECRET, force-invalidate all existing sessions, audit the admin user list and SSH terminal command history for unauthorized activity, and rotate any credentials/SSH keys stored within Dokploy.