CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 4.6.59 are vulnerable due to insufficient verification of HMAC signatures in their WhatsApp and Linear bot webhook handlers, allowing remote unauthenticated clients to send unsigned requests. This vulnerability enables attackers to forge messages, impersonate users, and disrupt bot operations, posing a significant risk to the integrity and functionality of the system. Organizations utilizing PraisonAI should prioritize upgrading to version 4.6.59 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the webhook route can forge messages, comments, or agent-session events, impersonate platform users, influence agent prompts and actions, and disrupt bot processing. This issue is fixed in 4.6.59.