CVE-2026-45631CWE-798hardcoded-credentials

CVE-2026-45631

Critical · published May 29, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789") lets an unauthenticated attacker forge email verification JWTs, trigger auto-sign-in as admin, and execute commands on the host via the built-in SSH terminal. This vulnerability is fixed in 0.29.3.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00454 · 38.4th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-05-29T22:17Z
References (3)
https://github.com/Dokploy/dokploy/pull/4374 · [email protected]https://github.com/Dokploy/dokploy/security/advisories/GHSA-w3gm-rc4p-9rhj · [email protected]https://github.com/Dokploy/dokploy/security/advisories/GHSA-w3gm-rc4p-9rhj · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 29 MAY 16:13Z
    Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret
    cvelistv5