CVE-2026-45791

mediumpriority · track · 0EPSS 0.004 · 34 %ileEU

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.41% (34th) EPSS

CVSS 5.9 · medium

Is it mine?

1 products

Check your exposure

Who says so?

1 sources

enisa_euvd

EPSS · scored 2026-10-22

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.

01

cvss

Technical severity, 0–10. One row per scoring source.

5.9

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · security-advisories@github.comexploitability 2.2 · impact 3.6

v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS

03

weaknesses

The CWE weakness classes this flaw belongs to.

04

affected products (1)

Products and version ranges known to be affected.

Dokploy dokploy≤ < 0.29.6enisa_euvdEU

05

also known as (1)

Other names and identifiers for this entity.

EUVD-2026-60477 enisa_euvd

06

sources

Which sources assert this record, and when.

enisa_euvd NVD CVE.org MITRE

published 2026-08-17modified 2026-08-18

07

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.