CVE-2026-45791: Dokploy Session Persistence Auth Bypass

CVE-2026-45791 Overview

CVE-2026-45791 is a session management vulnerability in Dokploy, a self-hostable Platform as a Service (PaaS). The flaw resides in the user.update procedure defined in apps/dokploy/server/api/routers/user.ts. When a user changes their password, the procedure updates account.password but fails to invalidate other rows in the session table. A compromised better-auth.session_token session remains valid for up to three days after a password change. This weakness maps to [CWE-613: Insufficient Session Expiration]. Dokploy released a fix in version 0.29.6.

Critical Impact
Attackers holding a stolen session token retain access to Dokploy accounts even after victims rotate their passwords, undermining the primary account-recovery control.

Affected Products

Dokploy versions prior to 0.29.6
Dokploy self-hosted PaaS deployments using better-auth session tokens
Dokploy user.update API procedure in apps/dokploy/server/api/routers/user.ts

Discovery Timeline

2026-08-17 - CVE-2026-45791 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-45791

Vulnerability Analysis

Dokploy relies on the better-auth library to manage authenticated sessions through the better-auth.session_token cookie. Session records are persisted in the database and referenced by that token. The user.update tRPC procedure allows an authenticated user to change account attributes, including their password stored in account.password. The procedure writes the new password hash without executing a companion delete against related session rows. As a result, any previously established session, including one that has been stolen, remains authoritative until natural expiry, which can be up to three days.

Root Cause

The root cause is insufficient session expiration on credential change. Password rotation is expected to serve as a compensating control after a suspected compromise. In user.ts, the update path lacks logic to enumerate and revoke sibling entries in the session table tied to the same userId. The database state therefore permits continued authentication with stale tokens.

Attack Vector

An attacker who has previously obtained a valid better-auth.session_token, through phishing, cross-site scripting, malware, or log exposure, can continue to invoke authenticated Dokploy APIs and access deployment controls. Even if the legitimate user detects the compromise and resets their password, the attacker's session token continues to authenticate requests until the session's natural expiration window elapses.

// Patch context from Dokploy v0.29.5 release commit
// apps/dokploy/components/dashboard/application/advanced/show-resources.tsx
<FormLabel>Memory Limit</FormLabel>
<TooltipProvider>
    <Tooltip delayDuration={0}>
-       <TooltipTrigger>
+       <TooltipTrigger type="button">
            <InfoIcon className="h-4 w-4 text-muted-foreground" />
        </TooltipTrigger>
// Source: https://github.com/Dokploy/dokploy/commit/a07106d649991ea09892220873ea3243766c3e08

See the GitHub Security Advisory GHSA-rr9m-w87g-46f3 for the full server-side fix that adds session deletion to the user.update flow.

Detection Methods for CVE-2026-45791

Indicators of Compromise

Multiple active session table rows for the same userId persisting after a recorded password change event.
Authenticated Dokploy API requests originating from IP addresses or user agents that differ from the account owner's recent baseline.
Access to deployment, environment variable, or container APIs immediately following a password reset by the same user.

Detection Strategies

Query the Dokploy database for rows in session where createdAt predates the last account.password update timestamp for the corresponding userId.
Correlate password change events emitted by user.update with subsequent authenticated activity that reuses pre-change session tokens.
Alert on concurrent sessions for the same account from geographically or network-distant sources.

Monitoring Recommendations

Enable and centralize Dokploy access logs, forwarding authenticated request metadata to a SIEM for correlation.
Monitor reverse proxy or ingress logs for repeated use of a better-auth.session_token cookie value across disparate clients.
Track administrative actions such as deployment triggers, secret reads, and user role changes for review after any password reset.

How to Mitigate CVE-2026-45791

Immediate Actions Required

Upgrade all Dokploy instances to version 0.29.6 or later without delay.
Manually purge all rows from the session table for users who have changed passwords since a suspected compromise.
Force reauthentication for every active Dokploy user after applying the upgrade.

Patch Information

The fix is delivered in Dokploy 0.29.6. The upstream patch is tracked in the GitHub Pull Request Discussion and the associated GitHub Commit Notes. Full advisory details are published in the GitHub Security Advisory GHSA-rr9m-w87g-46f3.

Workarounds

Truncate or selectively delete affected rows in the session table after any password change until the upgrade is applied.
Shorten the better-auth session lifetime configuration to reduce the window during which stale tokens remain valid.
Restrict Dokploy administrative endpoints to trusted networks or VPN clients to limit reuse of stolen tokens.

bash

# Post-password-change session cleanup on the Dokploy database
# Replace <user_id> with the affected user's identifier
psql -U dokploy -d dokploy -c "DELETE FROM session WHERE \"userId\" = '<user_id>';"

# Verify no residual sessions remain
psql -U dokploy -d dokploy -c "SELECT id, \"userId\", \"expiresAt\" FROM session WHERE \"userId\" = '<user_id>';"