CyberRota Analysis
AI-GeneratedThe PraisonAI Platform versions prior to 0.1.4 are vulnerable due to a hardcoded JWT signing secret, which can be exploited by attackers to forge tokens and impersonate any user, including administrators. This critical vulnerability poses a significant risk to user authentication and data integrity, making it imperative for organizations using this platform to prioritize upgrading to version 0.1.4 or later. All users of the PraisonAI Platform should take immediate action to mitigate potential unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal `"dev-secret-change-me"` when `PLATFORM_JWT_SECRET` is unset. A safety check exists but only fires when `PLATFORM_ENV != "dev"`; the default value of `PLATFORM_ENV` is `"dev"`, so the check is silently bypassed in any deployment that does not explicitly opt out. The attacker reads the literal from this public source file, mints a JWT with arbitrary `sub` and `email` claims, and authenticates as any existing user (including workspace owners and admins). PraisonAI Platform version 0.1.4 patches the issue.