CVE-2026-45791CWE-613

CVE-2026-45791

Medium · published August 18, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00408 · 33.9th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-08-18T02:17Z
References (4)
https://github.com/Dokploy/dokploy/commit/a07106d649991ea09892220873ea3243766c3e08 · [email protected]https://github.com/Dokploy/dokploy/pull/4475 · [email protected]https://github.com/Dokploy/dokploy/security/advisories/GHSA-rr9m-w87g-46f3 · [email protected]https://github.com/Dokploy/dokploy/security/advisories/GHSA-rr9m-w87g-46f3 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 AUG 21:25Z
    Dokploy: Password Change Does Not Revoke Active Sessions
    cvelistv5