CVE-2026-45791

In Dokploy before 0.29.6, the user.update procedure updates account.password without deleting other rows from the session table, so a compromised better-auth.session_token session remains valid for up to three days after a password change. This allows continued access to the account despite a cre...