Description

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET is unset, while the startup and token-issuance guards are disabled because PLATFORM_ENV also defaults to dev. An unauthenticated attacker can sign a JWT containing an attacker-chosen sub value, and AuthService._verify_token() accepts it as an authenticated identity, enabling user or workspace-owner impersonation when a target identifier is known. This vulnerability is fixed in praisonai-platform 0.1.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-15T11:17:11.910Z",
  "pubdate": "2026-09-15T11:17:11.910Z",
  "executiveSummary": "The praisonai-platform is susceptible to an authentication bypass vulnerability due to the use of a hardcoded, default cryptographic signing key for JSON Web Tokens (JWT).\nThis vulnerability exists because the system defaults to 'dev-secret-change-me' as the HS256 secret when the PLATFORM_JWT_SECRET environment variable is not explicitly configured.\nFurthermore, the PLATFORM_ENV environment variable defaults to 'dev', which inadvertently disables critical startup and token-issuance security guards.\nThis flaw allows unauthenticated remote attackers to forge valid JWTs with arbitrary 'sub' (subject) claims, effectively masquerading as any user or workspace owner within the platform.\nThe impact is critical, as it grants unauthorized access to sensitive administrative functions, user data, and workspace management capabilities without the need for prior authentication credentials.\nThe vulnerability is remediated in version 0.1.6, which addresses the insecure fallback logic and environmental security defaults.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of identity verification within praisonai_platform/services/auth_service.py. The application utilizes the HS256 (HMAC with SHA-256) algorithm to sign and verify JWTs. When the environment variable PLATFORM_JWT_SECRET is missing, the AuthService class falls back to a publicly known, static string: 'dev-secret-change-me'.\nBecause the platform environment defaults to 'dev', the runtime configuration disables essential security checks that would otherwise prevent the issuance or acceptance of tokens signed with weak or default secrets. This creates a scenario where the authentication mechanism is entirely transparent to an attacker who has identified the default key.\nThe attack flow proceeds as follows: First, an attacker identifies that the target instance is running a vulnerable version of praisonai-platform (prior to 0.1.6) and is configured with default environment parameters. Second, the attacker crafts a malicious JWT payload. By setting the 'sub' claim to a known victim's identifier (such as a system administrator or workspace owner), the attacker generates a JWT token signed using the 'dev-secret-change-me' key via the HMAC-SHA256 algorithm.\nThird, the attacker transmits this forged token in the Authorization header of an HTTP request. The AuthService._verify_token() function receives the token and, lacking a custom secret, verifies the signature against the hardcoded default key. Since the signature is mathematically valid relative to that key, the function erroneously treats the token as authentic.\nConsequently, the system grants the attacker the permissions associated with the victim user. This bypasses all authentication requirements and ignores the intended authorization flow of the platform. An attacker can perform actions such as modifying platform configurations, accessing private workspaces, or exfiltrating data, all while appearing to the system as a legitimate, authenticated user. Post-exploitation, the attacker maintains this identity as long as they retain a validly signed, albeit forged, token."
}