CVE-2026-45791: Dokploy: Password Change Does Not Revoke Active Sessions
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dokployto a version that resolves this vulnerability.Fixed in 0.29.6
Event History
Frequently Asked Questions
Which deployments and accounts are exposed?
Dokploy instances running versions earlier than 0.29.6 are affected. The issue concerns accounts for which an attacker has already obtained a valid better-auth.session_token session token.
What does an attacker need to exploit this?
An attacker does not need to know the new password, but must possess a compromised valid session token. Changing the account password alone does not invalidate that token, which can remain usable for up to three days.
What should administrators do?
Upgrade Dokploy to version 0.29.6, which fixes the session-revocation behavior. The provided data does not specify an alternative mitigation for deployments that cannot immediately upgrade.