CVE-2026-45631 affects Dokploy, a self-hostable Platform as a Service, versions 0.27.0 to before 0.29.3. The vulnerability involves a hardcoded BETTER_AUTH_SECRET fallback value that allows unauthenticated attackers to forge email verification JWTs. Attackers can exploit this to auto-sign-in as administrator and execute commands on the host system via the built-in SSH terminal. The hardcoded secret 'better-auth-secret-123456789' enables complete system compromise. This critical authentication bypass vulnerability has been fixed in version 0.29.3.