SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-57148

CRITICAL · CVSS 9.8 EPSS 0.37% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-15 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The vulnerability in PraisonAI allows unauthenticated attackers to impersonate users or workspace owners by exploiting a fallback to a default signing key when the JWT secret is unset. This critical flaw, due to misconfigured environment settings, enables attackers to craft valid JWTs with arbitrary subject values, compromising user authentication. Organizations using versions prior to 0.1.6 should prioritize immediate updates to mitigate the risk of unauthorized access.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-57148
Severity
CRITICAL
CVSS
9.8
EPSS
0.37%

Original NVD Description

PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET is unset, while the startup and token-issuance guards are disabled because PLATFORM_ENV also defaults to dev. An unauthenticated attacker can sign a JWT containing an attacker-chosen sub value, and AuthService._verify_token() accepts it as an authenticated identity, enabling user or workspace-owner impersonation when a target identifier is known. This vulnerability is fixed in praisonai-platform 0.1.6.