Dokploy, a self-hosted Platform as a Service, contained an unauthenticated API endpoint that accepted a state parameter holding organization and user identifiers and then created a GitHub App provider using the supplied data. An attacker could manipulate this parameter to inject a provider containing a client_secret, webhook_secret, and PEM private key. This vulnerability allows the attacker to place sensitive material within another organization’s GitHub App configuration, potentially enabling unauthorized access to that organization’s repositories and automated services. The underlying weakness is the misuse of client‑side state data without authentication, classified as CWE‑306.

The issue is present in Dokploy versions before 0.29.13 and was fixed in the 0.29.13 release. It affects any deployment of Dokploy that has the /api/providers/github/setup route exposed without authentication or proper state validation.

The CVSS score of 7.5 indicates a high‑severity flaw, and the lack of an EPSS score implies no current data on exploit prevalence. Since the route is unauthenticated, the attack can be performed by anyone who can reach the Dokploy instance, making it a low‑barrier injection scenario. The vulnerability is not listed in CISA's KEV catalog at this time, but the potential to compromise an entire organization’s GitHub integration warrants immediate attention.