EUVD-2026-60477Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects the required pre-condition of possessing a stolen session token; C:H for full account access; I:N and A:N as the flaw only extends existing session validity.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.
AnalysisAI
Session token invalidation failure in Dokploy allows a stolen better-auth.session_token to persist for up to three days after a victim changes their password, providing an attacker with continued authenticated access even after the victim has attempted to remediate a compromised account. All self-hosted Dokploy deployments prior to version 0.29.6 running the unpatched user.update tRPC procedure are affected. No public exploit identified at time of analysis, but the attack requires only a previously obtained session token and no further interaction from the victim.
Technical ContextAI
The vulnerability resides in apps/dokploy/server/api/routers/user.ts, specifically the user.update tRPC procedure, which modifies the account.password column in the database without simultaneously revoking active rows in the better-auth.session_token table. The better-auth library manages session lifecycle with a configurable TTL - in this case up to three days - but Dokploy's password change flow does not invoke the session revocation API, leaving orphaned tokens fully valid. CWE-613 (Insufficient Session Expiration) precisely describes this pattern: when a credential change does not cascade to session invalidation, an attacker who captured a token before the password change retains full session-level access until natural TTL expiry. The affected product is confirmed via CPE cpe:2.3:a:dokploy:dokploy:*:*:*:*:*:*:*:* covering all versions prior to 0.29.6.
RemediationAI
Upgrade to Dokploy 0.29.6, which modifies the user.update procedure to revoke existing session tokens upon password change. The upstream fix is available at https://github.com/Dokploy/dokploy/commit/a07106d649991ea09892220873ea3243766c3e08 and the security advisory is at https://github.com/Dokploy/dokploy/security/advisories/GHSA-rr9m-w87g-46f3. For deployments unable to upgrade immediately, a compensating control is to manually purge the better-auth.session_token table rows for affected users through direct database access after any suspected compromise or forced password reset event; note this will log out all active sessions for those users including legitimate ones. Restricting network access to the Dokploy management interface to trusted IP ranges also reduces the attack surface by limiting where stolen session tokens can be replayed from.
Dokploy self-hosted PaaS prior to 0.26.6 has a critical command injection vulnerability (CVSS 9.9) allowing authenticate
Dokploy versions before 0.26.6 contain hardcoded database credentials in the installation script, causing nearly all dep
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated panel user run arbitrary commands o
Remote code execution in Dokploy 0.27.0 through 0.29.2 allows unauthenticated attackers to forge email-verification JWTs
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on
OS command injection in Dokploy self-hosted PaaS before 0.29.13 lets an authenticated member with service-deployment per
Command injection in Dokploy self-hostable PaaS before 0.29.13 lets an authenticated user with backup:read permission ru
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
OS command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user holding the backup-restor
Cross-tenant remote command execution in Dokploy (self-hosted PaaS) before 0.29.13 lets any authenticated user holding o
Command injection in Dokploy self-hosted PaaS versions prior to 0.29.13 lets an authenticated user with database-service
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today