Description

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the webhook route can forge messages, comments, or agent-session events, impersonate platform users, influence agent prompts and actions, and disrupt bot processing. This issue is fixed in 4.6.59.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-14T16:17:13.270Z",
  "pubdate": "2026-09-14T16:17:13.270Z",
  "executiveSummary": "PraisonAI versions prior to 4.6.59 are susceptible to an authentication bypass vulnerability within the WhatsApp and Linear bot webhook handlers.\nThe vulnerability arises from improper handling of HMAC signature verification, which is rendered conditional rather than mandatory.\nIf the environment variables WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET are not explicitly configured, the system defaults to processing unauthenticated and unsigned request bodies.\nThis design flaw allows remote, unauthenticated attackers to forge arbitrary webhook events, effectively impersonating platform users and service providers.\nThe impact includes the ability to inject malicious payloads into agent prompts, trigger unauthorized agent actions, compromise session integrity, and disrupt critical bot processing workflows.\nThe vulnerability represents a significant security risk, as it effectively removes the authentication layer for these communication channels, requiring no prior authorization or credentials for exploitation.\nThe issue is resolved in version 4.6.59 by ensuring mandatory verification of incoming requests.",
  "technicalDetails": "The root cause of this vulnerability lies in the conditional logic implemented within the webhook request parsing flow for the WhatsApp and Linear integrations. The application utilizes HMAC signatures to verify the authenticity and integrity of incoming webhook payloads. However, the implementation logic fails to enforce this check as a hard constraint.\nSpecifically, the code base performs signature verification only if the environment variables WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET are present. If these secrets are missing—either due to misconfiguration or omission by the administrator—the webhook handlers bypass the validation logic entirely. Consequently, the application proceeds to parse and dispatch raw, unsigned request bodies to the internal agent-processing pipeline.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the public-facing webhook endpoint exposed by the PraisonAI instance. Because the application logic does not mandate authentication when the aforementioned secrets are absent, the attacker can craft arbitrary JSON payloads mimicking legitimate WhatsApp or Linear events. By sending these payloads via standard HTTP POST requests to the webhook route, the attacker forces the system to treat the malicious data as trusted input.\nExploitation allows for significant downstream impact: 1) Impersonation: An attacker can spoof events from platform users, potentially tricking agents into believing a legitimate user has requested a specific action. 2) Prompt Injection: By injecting crafted content into comments or message fields, an attacker can influence the behavior of the LLM-based agent, potentially leading to unauthorized data exfiltration or logic subversion. 3) Action Manipulation: The attacker can trigger agent-session events, causing the system to execute tasks, modify agent states, or perform unauthorized operations within the integrated platforms. 4) Denial of Service: By flooding the webhook handler with malformed or computationally expensive payloads, an attacker can disrupt the bot's processing capabilities.\nThe vulnerability affects all PraisonAI instances running versions earlier than 4.6.59. It requires network exposure to the webhook endpoint and does not require any authentication or specific privilege level to initiate, as the system effectively fails to enforce authentication requirements at the application level when the security configuration is not strictly enforced."
}