CVE-2026-45791

Received Received - Intake

Session Token Persistence After Password Change in Dokploy

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-45791

Affected Vendors & Products

Vendor	Product	Version / Range
dokploy	dokploy	to 0.29.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

Dokploy is a self-hostable Platform as a Service (PaaS). The vulnerability exists in the user.update procedure where changing a password does not invalidate existing session tokens. This allows a compromised session token to remain valid for up to three days after a password change.

Detection Guidance

To detect this vulnerability, check if Dokploy instances are running versions prior to 0.29.6. Inspect session tokens for persistence beyond password changes. Review user update logs for improper session handling. No specific commands are provided in the context.

Impact Analysis

If an attacker gains access to a valid session token, they can maintain access to the account even after the password is changed. This extends the window of unauthorized access to up to three days, potentially leading to data breaches or further exploitation.

Compliance Impact

This vulnerability could violate compliance requirements that mandate timely revocation of access after password changes, such as GDPR's data protection principles or HIPAA's access control rules. It may lead to unauthorized data exposure and non-compliance penalties.

Mitigation Strategies

Upgrade Dokploy to version 0.29.6 or later to address the vulnerability. Review active sessions and invalidate any suspicious or unnecessary sessions after password changes.

Hi! I’m here to help you understand CVE-2026-45791. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70