← Back to the live CVE advisory feed

CVE-2026-57148: PraisonAI

Severity

9.8 (CRITICAL)

Vendor

MERVINPRAISON

Affected versions

< 4.6.51; < 0.1.6

Fixed version

0.1.6

Patch status

Patched

Published

2026-09-15T11:17:11.910

Modified

2026-09-15T14:45:28.563

Why it matters

This matters because the issue affects identity or token handling. Successful exploitation could allow unauthorized authentication, client manipulation, or access to protected services.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET is unset, while the startup and token-issuance guards are disabled because PLATFORM_ENV also defaults to dev. An unauthenticated attacker can sign a JWT containing an attacker-chosen sub value, and AuthService._verify_token() accepts it as an authenticated identity, enabling user or workspace-owner impersonation when a target identifier is known. This vulnerability is fixed in praisonai-platform 0.1.6.

View the official NVD record for CVE-2026-57148

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.