CyberRota Analysis
AI-GeneratedPraisonAI's AgentServer prior to version 1.6.58 is vulnerable due to improper authentication checks, allowing remote attackers to perform actions such as subscribing and publishing without valid credentials. This can lead to unauthorized access and manipulation of the system, posing significant risks to data integrity and confidentiality. Organizations using affected versions should prioritize upgrading to version 1.6.58 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when authentication is configured. This issue is fixed in version 1.6.58.