by Kastro
Paper/Archive/CVE-2026-45631

CVE-2026-45631

Dokploy dokploy — Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret

EPSS 0.5%public exploitCVSS 10.0
critical.is priorityof 100
48
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 39.4.394 × 207.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789") lets an unauthenticated attacker forge email verification JWTs, trigger auto-sign-in as admin, and execute commands on the host via the built-in SSH terminal. This vulnerability is fixed in 0.29.3.

Affected

ProductAffectedFixed inSource
dokploy>= 0.27.0, < 0.29.3–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/Dokploy/dokploy/security/advisories/GHSA-w3gm-rc4p-9rhjrefgithub.com/Dokploy/dokploy/pull/4374