The flaw resides in Dokploy’s user update routine, which updates a user’s password without expiring existing session tokens. As a result, a session that was valid prior to the password change remains active for up to three days, allowing an attacker who has compromised or intercepted that session token to continue accessing the account. This vulnerability directly affects confidentiality and integrity by enabling unauthorized continued access to account resources, especially if the attacker gains legitimate session credentials before the password change.

Dokploy Platform as a Service, version 0.29.5 and earlier, has been identified as vulnerable. The fix is delivered in version 0.29.6, which removes the session persistence after a password change.

The CVSS score of 5.9 indicates a moderate risk. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the issue by first obtaining a valid session token—through phishing, credential theft, or session hijacking—and then ensuring that the account’s password is changed, either maliciously or accidentally, without triggering a session revocation. The workaround is limited; therefore, the most effective mitigation is to apply the available patch as soon as possible.