CyberRota Analysis
AI-GeneratedPraisonAI's authentication service is vulnerable due to the improper handling of JWT secrets, allowing remote unauthenticated attackers to generate valid HS256 tokens with arbitrary user identities when certain environment variables are unset. This critical flaw can lead to unauthorized access to protected API routes, compromising user data and system integrity. Organizations using versions prior to 0.1.6 should prioritize immediate updates to mitigate this severe security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me value to JWT_SECRET when PLATFORM_JWT_SECRET is unset, and its production guard does not run when PLATFORM_ENV is also unset because that setting defaults to dev. A remote unauthenticated attacker can mint an HS256 token with an arbitrary sub and email, and the platform's AuthService._verify_token() and get_current_user dependency accept the forged identity for protected API routes. This vulnerability is fixed in praisonai-platform 0.1.6.