VulnSocial

CVE-2026-45631Patch

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789") lets an unauthenticated attacker forge email verification JWTs, trigger auto-sign-in as admin, and execute commands on the host via the built-in SSH terminal. This vulnerability is fixed in 0.29.3.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-798

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-05-30: 1Patch / Workaround · 2026-05-30: 1Technical Details · 2026-05-30: 105-30
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • SecAlerts@SecAlertsCo
    Patch

    CVE-2026-45631: Dokploy 0.27.0-0.29.2 has a hardcoded auth secret that lets anyone take over as admin with zero credentials. CVSS 10. No auth. No interaction. Upgrade to 0.29.3 now. #infosec https://secalerts.co/vulnerability/CVE-2026-45631 https://t.co/X3t3Ijx72Z

    Post summary

    CVE‑2026‑45631 exposes a hardcoded auth secret in Dokploy 0.27.0‑0.29.2, enabling admin takeover without credentials; upgrading to 0.29.3 is advised to mitigate the high‑severity flaw.

    0000076
    826 followersView on X

Explore more

Back to dashboard