CyberRota Analysis
AI-GeneratedThe vulnerability in PraisonAI allows unauthenticated attackers to impersonate users or workspace owners by exploiting a fallback to a default signing key when the JWT secret is unset. This critical flaw, due to misconfigured environment settings, enables attackers to craft valid JWTs with arbitrary subject values, compromising user authentication. Organizations using versions prior to 0.1.6 should prioritize immediate updates to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py falls back to the public dev-secret-change-me HS256 signing key when PLATFORM_JWT_SECRET is unset, while the startup and token-issuance guards are disabled because PLATFORM_ENV also defaults to dev. An unauthenticated attacker can sign a JWT containing an attacker-chosen sub value, and AuthService._verify_token() accepts it as an authenticated identity, enabling user or workspace-owner impersonation when a target identifier is known. This vulnerability is fixed in praisonai-platform 0.1.6.