Executive brief
Dokploy, a self-hostable platform for managing applications and databases, contains a security flaw where it uses a publicly known, hardcoded secret key for authentication. An unauthenticated attacker can use this known secret to forge digital signatures, allowing them to log in as an administrator without a password. Once logged in, the attacker has full control over the server, including the ability to steal sensitive data, access stored credentials, and execute arbitrary commands on the underlying host system.
Technical details
Dokploy (versions 0.27.0 to 0.29.2) contains a hardcoded fallback value for the 'BETTER_AUTH_SECRET' environment variable in its server constants. Because the default installation script does not generate a unique secret, many self-hosted instances use the default string 'better-auth-secret-123456789'. An unauthenticated attacker can exploit this by forging HS256-signed JSON Web Tokens (JWTs) for the '/api/auth/verify-email' endpoint. Successful verification triggers an automatic administrative session creation due to the 'autoSignInAfterVerification' configuration. This grants the attacker full admin access, which includes the ability to execute commands on the host via the integrated SSH terminal. The issue is resolved in version 0.29.3 by removing the hardcoded fallback and implementing unique secret generation during setup.
Affected products
- Dokploy Dokploy 0.27.0 to 0.29.2
Timeline
- 2026-05-09: patched: Fix merged into canary branch via Pull Request 4374
- 2026-05-11: advisory: GitHub Security Advisory GHSA-w3gm-rc4p-9rhj published
- 2026-05-29: disclosed: CVE-2026-45631 published to NVD