CyberRota Analysis
AI-GeneratedDokploy versions prior to 0.29.6 are vulnerable due to a flaw in the user.update procedure, which permits the retention of a compromised session token for up to three days after a password change. This allows attackers to maintain access to user accounts even after the password has been updated, potentially leading to unauthorized actions. Organizations using Dokploy should prioritize upgrading to version 0.29.6 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.