Dokploy, a self‑hosted platform as a service, contains a flaw that lets an unauthenticated attacker forge email verification JWTs using a hardcoded secret, automatically sign in as an admin, and execute arbitrary commands on the host via the built‑in SSH terminal. This provides full administrative control, allowing the attacker to modify, delete, or exfiltrate data and compromise the underlying infrastructure. The vulnerability is a case of insecure default credentials (CWE‑798) and carries a CVSS score of 10.

The affected products are Dokploy Dokploy version 0.27.0 through 0.29.2. The issue is fixed starting with 0.29.3; earlier releases remain vulnerable.

The CVSS score of 10 and lack of an EPSS rating indicate a high‑severity flaw with potentially low known exploitation, but the vulnerability is listed as not in the CISA KEV catalog. Attackers can exploit the flaw by sending a forged JWT to the web interface, which is likely reachable over the network; no special setup beyond the application exposure is required. Remediation is critical to prevent full administrative takeover and remote command execution.