CVE-2026-72871

CVE-2026-72871 is an OAuth state parameter injection in Dokploy versions prior to 0.29.13. When setting up a GitHub App provider, the application encodes the target organization ID and user ID directly into the OAuth state parameter sent to GitHub during the authorization redirect. Since this state parameter travels through the client browser without any server-side integrity check—no HMAC signature, no reference to a server-stored record—an attacker who can initiate the OAuth flow or intercept/modify the state parameter can substitute their own organization ID and bind a malicious GitHub App to a victim's organization. The impact extends well beyond the initial injection. A successfully planted GitHub App provides the attacker with persistent credentials (PEM private key, client secret) that survive password resets and 2FA changes. These credentials grant access to the organization's repositories and CI/CD pipelines, meaning every future deployment becomes a potential exfiltration vector through a channel GitHub trusts by default. This persistence is the critical difference from session theft: the attacker doesn't need to maintain a foothold—they've inserted infrastructure that lives in your organization's settings until manually detected and removed. The CVSS 7.5 rating captures the technical severity but underweights the blast radius and the systemic nature of this vulnerability class. OAuth state parameter injection with credential injection appears repeatedly across self-hosted platforms because the stateless callback design creates genuine friction: the callback has no session cookie, so developers must communicate "which organization" somehow. The insecure shortcut is encoding that context in the state parameter; the secure alternatives (database-backed pending setup records, HMAC-signed state with key management) require more infrastructure and commits. The ecosystem has documented the secure patterns since at least 2019, yet the vulnerability frequency remains flat—because the secure path is architecturally inconvenient and the insecure path passes code review. If you run Dokploy, update to 0.29.13 immediately. More importantly, audit your existing GitHub App integrations: the patch fixes the injection vector but does not automatically revoke credentials planted during the vulnerable window. Check your organization settings for any GitHub Apps you didn't intentionally install, revoke any suspicious integrations, and rotate any secrets or keys they may have accessed. For self-hosted operators, there's no automated audit trail telling you whether you were targeted—manual review of your provider list is the only detection method. The underlying lesson is that OAuth callback security requires more than just generating a random state string. The state parameter must either carry a server-generated reference to stored context (not client-supplied IDs) or be cryptographically signed with a key managed separately from the application code. Treat any OAuth implementation that encodes organization or user identifiers directly in the state as vulnerable until proven otherwise.

Reviewed through automated stages and approved by a human before publication.